Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DMv89K955Y.exe

Overview

General Information

Sample name:DMv89K955Y.exe
renamed because original name is a hash value
Original sample name:26d8d52bac8f4615861f39e118efa28d.exe
Analysis ID:1546941
MD5:26d8d52bac8f4615861f39e118efa28d
SHA1:efd5a7ccd128ffe280af75ec8b3e465c989d9e35
SHA256:8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f
Tags:32exetrojan
Infos:

Detection

LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Yara detected Clipboard Hijacker
Yara detected Cryptbot
Yara detected LummaC Stealer
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • DMv89K955Y.exe (PID: 4884 cmdline: "C:\Users\user\Desktop\DMv89K955Y.exe" MD5: 26D8D52BAC8F4615861F39E118EFA28D)
    • RegAsm.exe (PID: 5764 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • RegAsm.exe (PID: 988 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • c.exe (PID: 7032 cmdline: "C:\Users\user\AppData\Local\Temp\10000600101\c.exe" MD5: 4936C0448E4102EF927A39DBF8091A28)
        • conhost.exe (PID: 640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • c.exe (PID: 6892 cmdline: "C:\Users\user\AppData\Local\Temp\10000600101\c.exe" MD5: 4936C0448E4102EF927A39DBF8091A28)
        • WerFault.exe (PID: 7012 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • 5.exe (PID: 6360 cmdline: "C:\Users\user\AppData\Local\Temp\10000610101\5.exe" MD5: FACECD9A8C5218A49469DF1C3756D5F9)
        • chrome.exe (PID: 5096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
          • chrome.exe (PID: 4992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,15013827744706186800,13121207676491278986,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
        • service123.exe (PID: 352 cmdline: "C:\Users\user\AppData\Local\Temp\service123.exe" MD5: B66A61DD0EFDB3AD15CE2756930C2003)
        • schtasks.exe (PID: 940 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)
          • conhost.exe (PID: 3908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WerFault.exe (PID: 5588 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 536 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • 449e940ceb.exe (PID: 3360 cmdline: "C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe" MD5: 39683F5EFD3B4C5C87C9105789937C4F)
        • InstallUtil.exe (PID: 5828 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • Application.exe (PID: 6980 cmdline: "C:\ProgramData\LgAmARwZ\Application.exe" MD5: 26D8D52BAC8F4615861F39E118EFA28D)
    • RegAsm.exe (PID: 2524 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • Application.exe (PID: 6228 cmdline: "C:\ProgramData\yIVKiWQb\Application.exe" MD5: 39683F5EFD3B4C5C87C9105789937C4F)
    • InstallUtil.exe (PID: 6556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
  • service123.exe (PID: 3184 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: B66A61DD0EFDB3AD15CE2756930C2003)
  • service123.exe (PID: 4508 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: B66A61DD0EFDB3AD15CE2756930C2003)
  • service123.exe (PID: 2736 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: B66A61DD0EFDB3AD15CE2756930C2003)
  • service123.exe (PID: 2728 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: B66A61DD0EFDB3AD15CE2756930C2003)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
NameDescriptionAttributionBlogpost URLsLink
CryptBotA typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Malware Configuration

Threatname: LummaC

{"C2 url": ["servicedny.site", "authorisev.site", "seallysl.site", "contemteny.site", "faulteyotk.site", "opposezmny.site", "goalyfeastz.site", "dilemmadu.site"], "Build id": "LD4nST--Exodus"}

Threatname: Cryptbot

{"C2 list": ["%gPfivejo5vt.top", "0.0.fivejo5vt.top", "0/80/fivejo5vt.top", "CTR-DRBG.top", "fivejo5vt.top", "QUERY|rd|AAAA|IN|fivejo5vt.top", "analforeverlovyu.top"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    00000012.00000003.3440249875.000000000DBED000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CryptbotYara detected CryptbotJoe Security
      0000000E.00000003.3079021722.000000000285F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        0000000E.00000003.3079043172.0000000002865000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CryptbotYara detected CryptbotJoe Security
            Click to see the 9 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10000610101\5.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10000610101\5.exe, ParentProcessId: 6360, ParentProcessName: 5.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 940, ProcessName: schtasks.exe
            Sigma detected: Browser Started with Remote Debugging
            Source: Process startedAuthor: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10000610101\5.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10000610101\5.exe, ParentProcessId: 6360, ParentProcessName: 5.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 5096, ProcessName: chrome.exe
            Sigma detected: Suspicious Add Scheduled Task Parent
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10000610101\5.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10000610101\5.exe, ParentProcessId: 6360, ParentProcessName: 5.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 940, ProcessName: schtasks.exe
            Sigma detected: Suspicious Schtasks From Env Var Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10000610101\5.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10000610101\5.exe, ParentProcessId: 6360, ParentProcessName: 5.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 940, ProcessName: schtasks.exe

            Data Obfuscation

            barindex
            Sigma detected: Drops script at startup location
            Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\DMv89K955Y.exe, ProcessId: 4884, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for dropped file
            Source: C:\ProgramData\yIVKiWQb\Application.exeAvira: detection malicious, Label: HEUR/AGEN.1357785
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeAvira: detection malicious, Label: HEUR/AGEN.1357785
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exeAvira: detection malicious, Label: HEUR/AGEN.1357785
            Found malware configuration
            Source: 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: LummaC {"C2 url": ["servicedny.site", "authorisev.site", "seallysl.site", "contemteny.site", "faulteyotk.site", "opposezmny.site", "goalyfeastz.site", "dilemmadu.site"], "Build id": "LD4nST--Exodus"}
            Source: 5.exe.6360.18.memstrminMalware Configuration Extractor: Cryptbot {"C2 list": ["%gPfivejo5vt.top", "0.0.fivejo5vt.top", "0/80/fivejo5vt.top", "CTR-DRBG.top", "fivejo5vt.top", "QUERY|rd|AAAA|IN|fivejo5vt.top", "analforeverlovyu.top"]}
            Multi AV Scanner detection for dropped file
            Source: C:\ProgramData\LgAmARwZ\Application.exeReversingLabs: Detection: 60%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\5[1].exeReversingLabs: Detection: 45%
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeReversingLabs: Detection: 45%
            Multi AV Scanner detection for submitted file
            Source: DMv89K955Y.exeReversingLabs: Detection: 60%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\ProgramData\yIVKiWQb\Application.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].exeJoe Sandbox ML: detected
            Source: C:\ProgramData\LgAmARwZ\Application.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: DMv89K955Y.exeJoe Sandbox ML: detected
            Sample uses string decryption to hide its real strings
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: servicedny.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: authorisev.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: faulteyotk.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: dilemmadu.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: contemteny.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: goalyfeastz.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: opposezmny.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: seallysl.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: opposezmny.site
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: lid=%s&j=%s&ver=4.0
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: TeslaBrowser/5.5
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: - Screen Resoluton:
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: - Physical Installed Memory:
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: Workgroup: -
            Source: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmpString decryptor: LD4nST--Exodus
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041D5AF CryptUnprotectData,14_2_0041D5AF
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007615B0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,30_2_007615B0
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_646535c9-c
            Source: DMv89K955Y.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005262C7 FindFirstFileExW,8_2_005262C7
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00526378 FindFirstFileExW,FindNextFileW,FindClose,FindClose,8_2_00526378
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043F371 FindFirstFileExW,13_2_0043F371
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_005262C7 FindFirstFileExW,14_2_005262C7
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00526378 FindFirstFileExW,FindNextFileW,FindClose,FindClose,14_2_00526378
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]14_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [ebx], dl14_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]14_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx esi, byte ptr [eax]14_2_004441F0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_0044137E
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_004413D5
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp eax14_2_0041D5AF
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, eax14_2_0043A97E
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h14_2_0043A97E
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h14_2_0043A97E
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [ebx], cl14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ecx, eax14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then lea edx, dword ptr [eax-80h]14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov dword ptr [esi+04h], eax14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [ebx], al14_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov dword ptr [eax+ebx], 30303030h14_2_00401000
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov dword ptr [eax+ebx], 20202020h14_2_00401000
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h14_2_0043B170
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]14_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [ebx], dl14_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]14_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edx, ecx14_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp edx14_2_004431D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_004431D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h]14_2_004241E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp edx14_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp edx14_2_004432C0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_004432C0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [eax+ebx], 00000030h14_2_004012D5
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ecx, ebx14_2_00421333
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx esi, byte ptr [eax]14_2_00444380
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp edx14_2_004433B0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_004433B0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp byte ptr [esi+ebx], 00000000h14_2_0042E400
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]14_2_0042F4DD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]14_2_0042F4DD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov dword ptr [esi+04h], eax14_2_0042F4DD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [ebx], al14_2_0042F4DD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ebx, eax14_2_0040D500
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov word ptr [ebx], ax14_2_0041F510
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov byte ptr [esi], cl14_2_0041F510
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h]14_2_00441648
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx eax, word ptr [esi+ecx]14_2_0043C6D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov word ptr [eax], cx14_2_0041C6E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h]14_2_00441720
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_00443720
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h]14_2_0043F7E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then add ebp, dword ptr [esp+0Ch]14_2_0042E870
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [edi+ebx]14_2_00405820
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov word ptr [eax], cx14_2_0041C8CE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ecx, eax14_2_0040E8D6
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ebx, byte ptr [edx+esi]14_2_0040C960
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ecx, eax14_2_0040E996
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp eax14_2_0042AA40
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch]14_2_0042AA60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov word ptr [eax], cx14_2_0042CA72
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov word ptr [eax], cx14_2_0042CA72
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh]14_2_0043FAD0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edi, edx14_2_00421B40
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp al, 2Eh14_2_0042AC04
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edi, esi14_2_0041ECDE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx ebx, byte ptr [edx]14_2_00437CA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]14_2_0042DE70
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h14_2_00440E3A
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then mov edi, dword ptr [esp+54h]14_2_0042CEDA
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then jmp edx14_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then xor byte ptr [ecx+ebx], bl14_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h14_2_00425F00
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 4x nop then movzx edi, word ptr [edx]14_2_00428F00
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 4x nop then lea ecx, dword ptr [esp+04h]30_2_007681E0
            Source: chrome.exeMemory has grown: Private usage: 0MB later: 22MB

            Networking

            barindex
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: servicedny.site
            Source: Malware configuration extractorURLs: authorisev.site
            Source: Malware configuration extractorURLs: seallysl.site
            Source: Malware configuration extractorURLs: contemteny.site
            Source: Malware configuration extractorURLs: faulteyotk.site
            Source: Malware configuration extractorURLs: opposezmny.site
            Source: Malware configuration extractorURLs: goalyfeastz.site
            Source: Malware configuration extractorURLs: dilemmadu.site
            Source: Malware configuration extractorURLs: %gPfivejo5vt.top
            Source: Malware configuration extractorURLs: 0.0.fivejo5vt.top
            Source: Malware configuration extractorURLs: 0/80/fivejo5vt.top
            Source: Malware configuration extractorURLs: CTR-DRBG.top
            Source: Malware configuration extractorURLs: fivejo5vt.top
            Source: Malware configuration extractorURLs: QUERY|rd|AAAA|IN|fivejo5vt.top
            Source: Malware configuration extractorURLs: analforeverlovyu.top
            Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
            Source: Joe Sandbox ViewIP Address: 13.89.179.12 13.89.179.12
            Source: Joe Sandbox ViewIP Address: 103.130.147.211 103.130.147.211
            Source: Joe Sandbox ViewIP Address: 103.130.147.211 103.130.147.211
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004125A0 recv,recv,recv,recv,13_2_004125A0
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
            Source: chrome.exe, 00000016.00000003.3384896118.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384466006.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384654214.0000460000F7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
            Source: chrome.exe, 00000016.00000003.3384896118.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384466006.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384654214.0000460000F7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
            Source: chrome.exe, 00000016.00000002.3419419588.00004600002E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
            Source: 5.exe, 00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmp, 5.exe, 00000012.00000002.4184393887.000000000097E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: HTTP://fivejo5vt.top/v1/upload.php
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: http://.css
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: http://.jpg
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136F
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078e2
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498S
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3862
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965=
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970K
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324K
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722F
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420402627.00004600004B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5901
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/59065
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906Fh
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6141
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6248
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860F
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876e-data
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6929
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6953
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420402627.00004600004B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370F
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488
            Source: chrome.exe, 00000016.00000002.3420771216.0000460000534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7553
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7556
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420402627.00004600004B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761V
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162;
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
            Source: chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
            Source: chrome.exe, 00000016.00000002.3421247269.0000460000658000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
            Source: c.exe, 0000000E.00000003.3151538674.000000000284C000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153342354.000000000284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
            Source: chrome.exe, 00000016.00000002.3418964753.0000460000294000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://google.com/
            Source: 5.exe.5.drString found in binary or memory: http://home.fivejo5vt.top/jQDBoCTTJMoxHduEQtVi17
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: http://html4/loose.dtd
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
            Source: chrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://jsbin.com/temexa/4.
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
            Source: chrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://polymer.github.io/AUTHORS.txt
            Source: chrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
            Source: chrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://polymer.github.io/LICENSE.txt
            Source: chrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://polymer.github.io/PATENTS.txt
            Source: chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
            Source: chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsF
            Source: chrome.exe, 00000016.00000002.3422619113.00004600009A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
            Source: Amcache.hve.17.drString found in binary or memory: http://upx.sf.net
            Source: chrome.exe, 00000016.00000002.3422677220.00004600009D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
            Source: c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
            Source: chrome.exe, 00000016.00000002.3418303802.0000460000074000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420402627.00004600004B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
            Source: chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422848846.0000460000A64000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
            Source: chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422984613.0000460000AB3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/MergeSession
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin
            Source: chrome.exe, 00000016.00000002.3421356195.00004600006C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
            Source: chrome.exe, 00000016.00000002.3418335798.0000460000098000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
            Source: chrome.exe, 00000016.00000002.3418335798.0000460000098000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
            Source: chrome.exe, 00000016.00000002.3418335798.0000460000098000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
            Source: chrome.exe, 00000016.00000002.3418303802.0000460000074000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
            Source: chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revokeF
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
            Source: chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multiloginF
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4830
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4966
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/6574
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369Fh
            Source: chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
            Source: chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604Fu2PFu2
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7899
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
            Source: chrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_apit
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: chrome.exe, 00000016.00000002.3423117332.0000460000AF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
            Source: chrome.exe, 00000016.00000002.3423117332.0000460000AF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
            Source: chrome.exe, 00000016.00000002.3423117332.0000460000AF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: chrome.exe, 00000016.00000002.3418535859.0000460000130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.co
            Source: chrome.exe, 00000016.00000002.3423726180.0000460000CC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
            Source: chrome.exe, 00000016.00000002.3425546993.0000460000FA0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/$
            Source: chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore206E5
            Source: chrome.exe, 00000016.00000002.3421150318.0000460000628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422786956.0000460000A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422677220.00004600009D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
            Source: chrome.exe, 00000016.00000002.3422786956.0000460000A30000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enF
            Source: chrome.exe, 00000016.00000002.3421150318.0000460000628000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enFb
            Source: chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstoreF
            Source: chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382240210.0000460000C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384199920.0000460000CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383968612.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423489684.0000460000C47000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384172904.00004600004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382201875.00004600004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419034683.00004600002A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382142539.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424126897.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420359901.0000460000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419879542.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382563558.0000460000C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382614897.0000460000CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418535859.0000460000130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382918683.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386241727.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423726180.0000460000CC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstoreLDDiscover
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
            Source: chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
            Source: chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
            Source: chrome.exe, 00000016.00000002.3423428250.0000460000C0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/g
            Source: chrome.exe, 00000016.00000003.3360351548.000010C8002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3360321600.000010C8002D8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/cr/report
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422880755.0000460000A99000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419034683.00004600002A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422186096.00004600008E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
            Source: chrome.exe, 00000016.00000002.3418421548.00004600000E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
            Source: chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxn
            Source: chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
            Source: chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bF
            Source: chrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
            Source: chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
            Source: chrome.exe, 00000016.00000002.3423752137.0000460000CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423591974.0000460000C7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
            Source: 5.exe.5.drString found in binary or memory: https://curl.se/docs/alt-svc.html
            Source: 5.exe.5.drString found in binary or memory: https://curl.se/docs/hsts.html
            Source: 5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drString found in binary or memory: https://curl.se/docs/http-cookies.html
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420359901.0000460000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actionsA
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420359901.0000460000498000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
            Source: chrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420359901.0000460000498000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
            Source: chrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-autHO8FHO8Fe.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.c
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.googl
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.googlP8FP8F//drive-daily-4.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
            Source: chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
            Source: chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
            Source: chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
            Source: chrome.exe, 00000016.00000002.3421150318.0000460000628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
            Source: chrome.exe, 00000016.00000002.3421150318.0000460000628000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=searchTerms
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtaby
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: 5.exe, 00000012.00000003.4130683296.0000000001359000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gcc.gnu.org/bugs/):
            Source: c.exe, 0000000E.00000002.3153289392.00000000027E7000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151725105.00000000027E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.si
            Source: c.exe, 0000000E.00000003.3140269536.0000000002866000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/
            Source: c.exe, 0000000E.00000003.3151538674.000000000284C000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153342354.000000000284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/.
            Source: c.exe, 0000000E.00000003.3023967346.0000000004FC0000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3026044811.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/23
            Source: c.exe, 0000000E.00000003.3008708581.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/Y2
            Source: c.exe, 0000000E.00000002.3153404999.0000000002873000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151725105.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3140232262.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3060220576.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153159020.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3115002079.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.00000000027CD000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3008708581.0000000002857000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151725105.00000000027E7000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153289392.0000000002800000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/api
            Source: c.exe, 0000000E.00000003.3151538674.000000000284C000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153342354.000000000284F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/apiW2
            Source: c.exe, 0000000E.00000003.3103777527.000000000286E000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103182664.000000000286D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/apial/
            Source: c.exe, 0000000E.00000002.3153404999.0000000002873000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3140232262.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3115002079.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103777527.000000000286E000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103182664.000000000286D000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3107301176.0000000002871000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/apids
            Source: c.exe, 0000000E.00000003.3060220576.0000000004FC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/apii4w
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/apis
            Source: c.exe, 0000000E.00000003.3060220576.0000000004FB3000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3060579604.0000000004FB9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/hq8
            Source: c.exe, 0000000E.00000003.3076090035.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3078951373.0000000004FC8000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076414351.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076286289.0000000004FC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/it
            Source: c.exe, 0000000E.00000003.3023967346.0000000004FC0000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3026044811.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/o
            Source: c.exe, 0000000E.00000003.3076090035.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076414351.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076286289.0000000004FC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/ot7
            Source: c.exe, 0000000E.00000003.3060220576.0000000004FB3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/pgbb
            Source: c.exe, 0000000E.00000003.3076090035.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076414351.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076286289.0000000004FC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site/ti
            Source: c.exe, 0000000E.00000003.3078951373.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076090035.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3114522726.0000000004FDF000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3101865226.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3114764523.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3060220576.0000000004FB3000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3107186963.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076375026.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151213951.0000000004FCE000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076214808.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3114522726.0000000004FCE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://goalyfeastz.site:443/api
            Source: chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
            Source: chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
            Source: chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
            Source: chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
            Source: chrome.exe, 00000016.00000003.3366970633.000021D800684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
            Source: chrome.exe, 00000016.00000003.3369687504.000021D8006E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418168595.000046000000C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/googleapis.comm
            Source: chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://googleusercontent.com/
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
            Source: chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/issues/166475273
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
            Source: 5.exe, 00000012.00000003.4157839794.0000000003CB0000.00000004.00000020.00020000.00000000.sdmp, 5.exe, 00000012.00000003.4157659651.000000006A629000.00000002.00001000.00020000.00000000.sdmpString found in binary or memory: https://keruzam.com/update.php?compName=
            Source: chrome.exe, 00000016.00000002.3417036954.000021D800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422677220.00004600009D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2
            Source: chrome.exe, 00000016.00000002.3417036954.000021D800238000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
            Source: chrome.exe, 00000016.00000003.3364157844.000021D800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418102188.000021D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
            Source: chrome.exe, 00000016.00000002.3417908261.000021D800770000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
            Source: chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422677220.00004600009D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiments
            Source: chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/upload
            Source: chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/uploadbyurl
            Source: chrome.exe, 00000016.00000003.3370333459.000021D8006EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload
            Source: chrome.exe, 00000016.00000003.3364793789.000021D80039C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload2
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
            Source: chrome.exe, 00000016.00000002.3417953681.000021D80078C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
            Source: chrome.exe, 00000016.00000002.3417883928.000021D800744000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
            Source: chrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
            Source: chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGAUpdate
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422116563.00004600008A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425471477.0000460000F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421407631.00004600006E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
            Source: chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3426409662.0000460001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421407631.00004600006E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
            Source: chrome.exe, 00000016.00000002.3426409662.0000460001030000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
            Source: chrome.exe, 00000016.00000002.3426409662.0000460001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421407631.00004600006E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
            Source: chrome.exe, 00000016.00000002.3418474230.00004600000F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424197898.0000460000DE4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myactivity.google.com/
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
            Source: chrome.exe, 00000016.00000002.3423146808.0000460000B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3427108194.0000460001130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3427439488.0000460001160000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ogs.google.com
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425433086.0000460000F6C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425433086.0000460000F6C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425433086.0000460000F6C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419419588.00004600002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425433086.0000460000F6C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425433086.0000460000F6C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
            Source: chrome.exe, 00000016.00000002.3425323551.0000460000F52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
            Source: chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424197898.0000460000DE4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
            Source: chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424222720.0000460000DF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
            Source: chrome.exe, 00000016.00000002.3418474230.00004600000F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424197898.0000460000DE4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://policies.google.com/
            Source: chrome.exe, 00000016.00000002.3418303802.0000460000074000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
            Source: chrome.exe, 00000016.00000002.3418499940.0000460000108000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
            Source: chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
            Source: chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
            Source: chrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsQ
            Source: c.exe, 0000000E.00000003.3062698174.00000000050D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
            Source: c.exe, 0000000E.00000003.3062698174.00000000050D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
            Source: chrome.exe, 00000016.00000002.3422677220.00004600009D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
            Source: chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
            Source: chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: chrome.exe, 00000016.00000002.3423726180.0000460000CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
            Source: chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/Char
            Source: chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/Charii3
            Source: chrome.exe, 00000016.00000002.3426757766.00004600010E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
            Source: chrome.exe, 00000016.00000002.3418448748.00004600000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3427439488.0000460001160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425228801.0000460000ED0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
            Source: chrome.exe, 00000016.00000002.3422150149.00004600008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425288918.0000460000F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
            Source: chrome.exe, 00000016.00000002.3422150149.00004600008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425288918.0000460000F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/gs
            Source: chrome.exe, 00000016.00000002.3424174274.0000460000DD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
            Source: c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423197629.0000460000B58000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: chrome.exe, 00000016.00000002.3423197629.0000460000B58000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoF
            Source: chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?q=$
            Source: chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
            Source: chrome.exe, 00000016.00000002.3422707150.00004600009F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/undo
            Source: chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
            Source: chrome.exe, 00000016.00000002.3420985816.00004600005E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
            Source: chrome.exe, 00000016.00000002.3420985816.00004600005E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/tokenn
            Source: chrome.exe, 00000016.00000002.3418881557.000046000020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
            Source: chrome.exe, 00000016.00000002.3423379010.0000460000BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/G
            Source: chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
            Source: c.exe, 0000000E.00000003.3062562940.0000000004FE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.or
            Source: c.exe, 0000000E.00000003.3062562940.0000000004FE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
            Source: c.exe, 0000000E.00000003.3062698174.00000000050D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
            Source: c.exe, 0000000E.00000003.3062698174.00000000050D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
            Source: c.exe, 0000000E.00000003.3062698174.00000000050D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
            Source: c.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419419588.00004600002E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,14_2_00435210
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,14_2_00435210
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004061F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,13_2_004061F0

            System Summary

            barindex
            .NET source code contains very large array initializations
            Source: 0.2.DMv89K955Y.exe.132d1a78.1.raw.unpack, searchX64LPVOIDhierarchy.csLarge array initialization: GetGuidArrayRestrictedSkipVisibilityChecks: array initializer size 440832
            Source: 0.2.DMv89K955Y.exe.1d4e0000.2.raw.unpack, searchX64LPVOIDhierarchy.csLarge array initialization: GetGuidArrayRestrictedSkipVisibilityChecks: array initializer size 440832
            Source: 0.0.DMv89K955Y.exe.e3408e.1.raw.unpack, searchX64LPVOIDhierarchy.csLarge array initialization: GetGuidArrayRestrictedSkipVisibilityChecks: array initializer size 440832
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34694E380_2_00007FFD34694E38
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34698A320_2_00007FFD34698A32
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD3469AE310_2_00007FFD3469AE31
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34699EB90_2_00007FFD34699EB9
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD3469A69D0_2_00007FFD3469A69D
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34695BCE0_2_00007FFD34695BCE
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD346964B10_2_00007FFD346964B1
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34696CEE0_2_00007FFD34696CEE
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD3469618F0_2_00007FFD3469618F
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34692E1D0_2_00007FFD34692E1D
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34696A050_2_00007FFD34696A05
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34695EF60_2_00007FFD34695EF6
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD346972EC0_2_00007FFD346972EC
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34696FD00_2_00007FFD34696FD0
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD346967740_2_00007FFD34696774
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004F80508_2_004F8050
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005089108_2_00508910
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004ED5808_2_004ED580
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004E10008_2_004E1000
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005128208_2_00512820
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004FC8E08_2_004FC8E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0050C8E08_2_0050C8E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051D9628_2_0051D962
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004F51708_2_004F5170
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005059308_2_00505930
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004EE1F08_2_004EE1F0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00517A008_2_00517A00
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00502AF08_2_00502AF0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00500AF08_2_00500AF0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0052BA908_2_0052BA90
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005103008_2_00510300
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005063208_2_00506320
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005074208_2_00507420
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004FF4E08_2_004FF4E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0052A4A28_2_0052A4A2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00506D508_2_00506D50
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005175408_2_00517540
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0052FDB28_2_0052FDB2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004FB6008_2_004FB600
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004FA6308_2_004FA630
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005036808_2_00503680
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005077408_2_00507740
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34694E3811_2_00007FFD34694E38
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34698A3211_2_00007FFD34698A32
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD3469A69D11_2_00007FFD3469A69D
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34692F3011_2_00007FFD34692F30
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34695BCE11_2_00007FFD34695BCE
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD3469AFB411_2_00007FFD3469AFB4
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD346964B111_2_00007FFD346964B1
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34696CEE11_2_00007FFD34696CEE
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD3469759911_2_00007FFD34697599
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD3469618F11_2_00007FFD3469618F
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34696A0511_2_00007FFD34696A05
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34695EF611_2_00007FFD34695EF6
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD346972EC11_2_00007FFD346972EC
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34696FD011_2_00007FFD34696FD0
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD3469677411_2_00007FFD34696774
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004460D413_2_004460D4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004061F013_2_004061F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004461F413_2_004461F4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004051A013_2_004051A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043D26913_2_0043D269
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0044444713_2_00444447
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0040545013_2_00405450
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042FA5B13_2_0042FA5B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043CADA13_2_0043CADA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042BB2013_2_0042BB20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00441CD713_2_00441CD7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00404EF013_2_00404EF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00432FA013_2_00432FA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004100C514_2_004100C5
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042509D14_2_0042509D
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041013014_2_00410130
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043A2E014_2_0043A2E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041D5AF14_2_0041D5AF
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044462014_2_00444620
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042A6D014_2_0042A6D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042680014_2_00426800
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040F97014_2_0040F970
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043A97E14_2_0043A97E
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042EB6014_2_0042EB60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040100014_2_00401000
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041011814_2_00410118
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004431D014_2_004431D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004331DE14_2_004331DE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004291E014_2_004291E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004241E014_2_004241E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00442EB014_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040F25014_2_0040F250
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040B26014_2_0040B260
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040A27014_2_0040A270
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043E23014_2_0043E230
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004432C014_2_004432C0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004012D514_2_004012D5
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041E29814_2_0041E298
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040834014_2_00408340
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040132814_2_00401328
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042C3E014_2_0042C3E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044238014_2_00442380
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004433B014_2_004433B0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042F4DD14_2_0042F4DD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042949414_2_00429494
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004094BF14_2_004094BF
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041F51014_2_0041F510
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004255A414_2_004255A4
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004335B014_2_004335B0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042D64214_2_0042D642
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042762D14_2_0042762D
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004386FE14_2_004386FE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004226A014_2_004226A0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042762D14_2_0042762D
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040D76014_2_0040D760
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044172014_2_00441720
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044372014_2_00443720
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040A73014_2_0040A730
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042949414_2_00429494
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042B7D914_2_0042B7D9
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042B7FE14_2_0042B7FE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044285014_2_00442850
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041482A14_2_0041482A
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004038E014_2_004038E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043994014_2_00439940
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040796014_2_00407960
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044492014_2_00444920
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043198014_2_00431980
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042AA4014_2_0042AA40
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042CA7214_2_0042CA72
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00420A2414_2_00420A24
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00421B4014_2_00421B40
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040DB2014_2_0040DB20
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00415BD814_2_00415BD8
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00439BA014_2_00439BA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00414BBF14_2_00414BBF
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00444C5014_2_00444C50
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00434C6014_2_00434C60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042AC0414_2_0042AC04
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0043EC2014_2_0043EC20
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040ECC014_2_0040ECC0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00427CD214_2_00427CD2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0041ECDE14_2_0041ECDE
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040BD7014_2_0040BD70
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00429D0014_2_00429D00
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0040ADD014_2_0040ADD0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00432D8014_2_00432D80
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00408DA014_2_00408DA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00422E5014_2_00422E50
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00416E1014_2_00416E10
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0042BE1014_2_0042BE10
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00442EB014_2_00442EB0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00406F6014_2_00406F60
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00428F0014_2_00428F00
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00408DA014_2_00408DA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00426F8214_2_00426F82
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00434F8014_2_00434F80
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00441F8014_2_00441F80
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00409F9C14_2_00409F9C
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00404FA014_2_00404FA0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00409FA814_2_00409FA8
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004F805014_2_004F8050
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004E100014_2_004E1000
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051282014_2_00512820
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004FC8E014_2_004FC8E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050C8E014_2_0050C8E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051D96214_2_0051D962
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004F517014_2_004F5170
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050891014_2_00508910
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050593014_2_00505930
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004EE1F014_2_004EE1F0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00517A0014_2_00517A00
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00502AF014_2_00502AF0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00500AF014_2_00500AF0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0052BA9014_2_0052BA90
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051030014_2_00510300
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050632014_2_00506320
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050742014_2_00507420
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004FF4E014_2_004FF4E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0052A4A214_2_0052A4A2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00506D5014_2_00506D50
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051754014_2_00517540
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004ED58014_2_004ED580
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0052FDB214_2_0052FDB2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004FB60014_2_004FB600
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004FA63014_2_004FA630
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050368014_2_00503680
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0050774014_2_00507740
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeCode function: 19_2_00007FFD3465117519_2_00007FFD34651175
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeCode function: 19_2_00007FFD3465302F19_2_00007FFD3465302F
            Source: C:\ProgramData\yIVKiWQb\Application.exeCode function: 21_2_00007FFD3469117521_2_00007FFD34691175
            Source: C:\ProgramData\yIVKiWQb\Application.exeCode function: 21_2_00007FFD3469302F21_2_00007FFD3469302F
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007651B030_2_007651B0
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_00763E2030_2_00763E20
            Source: Joe Sandbox ViewDropped File: C:\ProgramData\LgAmARwZ\Application.exe 8521A1F4D523A2A9E7F8DDF01147E65E7F3FF54B268E9B40F91E07DC01FA148F
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: String function: 0040C8C0 appears 70 times
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: String function: 0041C2A0 appears 176 times
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: String function: 0051B7C0 appears 84 times
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: String function: 0051FE58 appears 40 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 004245B0 appears 135 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 0042ABD0 appears 56 times
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 272
            Source: DMv89K955Y.exe, 00000000.00000002.2558935359.00000000032C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameriched20.dllp( vs DMv89K955Y.exe
            Source: DMv89K955Y.exe, 00000000.00000002.2558935359.00000000032C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs DMv89K955Y.exe
            Source: DMv89K955Y.exe, 00000000.00000002.2558935359.00000000032C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ,\\StringFileInfo\\000004B0\\OriginalFilename vs DMv89K955Y.exe
            Source: DMv89K955Y.exe, 00000000.00000000.2118777359.0000000000E32000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDellOptiplex.exe< vs DMv89K955Y.exe
            Source: DMv89K955Y.exeBinary or memory string: OriginalFilenameDellOptiplex.exe< vs DMv89K955Y.exe
            Source: DMv89K955Y.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: Application.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: random[1].exe.5.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: c[1].exe.5.drStatic PE information: Section: .back ZLIB complexity 1.0003314936926606
            Source: c.exe.5.drStatic PE information: Section: .back ZLIB complexity 1.0003314936926606
            Source: 0.2.DMv89K955Y.exe.132d1a78.1.raw.unpack, searchX64LPVOIDhierarchy.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.2.DMv89K955Y.exe.1d4e0000.2.raw.unpack, searchX64LPVOIDhierarchy.csCryptographic APIs: 'CreateDecryptor'
            Source: 0.0.DMv89K955Y.exe.e3408e.1.raw.unpack, searchX64LPVOIDhierarchy.csCryptographic APIs: 'CreateDecryptor'
            Source: 5.exe.5.drBinary string: Kntdll.dllNtCreateFileNtDeviceIoControlFileNtCancelIoFileEx\Device\Afd
            Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winEXE@43/20@0/14
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00432088 CoCreateInstance,14_2_00432088
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.urlJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6360
            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7032
            Source: C:\ProgramData\yIVKiWQb\Application.exeMutant created: NULL
            Source: C:\Users\user\AppData\Local\Temp\service123.exeMutant created: \Sessions\1\BaseNamedObjects\MpBOnLbIDJucBSIPSkJy
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3908:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:640:120:WilError_03
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\246122658369Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCommand line argument: ~"R8_2_005221D0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCommand line argument: ~"R14_2_005221D0
            Source: DMv89K955Y.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: DMv89K955Y.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
            Source: c.exe, 0000000E.00000003.3032750316.000000000287D000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3009126461.0000000004FE8000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3032056794.0000000004FE2000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3009667567.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3409122877.0000000003E81000.00000004.00000020.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3416165019.0000000003E81000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422374371.0000460000944000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: DMv89K955Y.exeReversingLabs: Detection: 60%
            Source: RegAsm.exeString found in binary or memory: " /add /y
            Source: RegAsm.exeString found in binary or memory: " /add
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile read: C:\Users\user\Desktop\DMv89K955Y.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\DMv89K955Y.exe "C:\Users\user\Desktop\DMv89K955Y.exe"
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\ProgramData\LgAmARwZ\Application.exe "C:\ProgramData\LgAmARwZ\Application.exe"
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 272
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\10000610101\5.exe "C:\Users\user\AppData\Local\Temp\10000610101\5.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe "C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: unknownProcess created: C:\ProgramData\yIVKiWQb\Application.exe "C:\ProgramData\yIVKiWQb\Application.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,15013827744706186800,13121207676491278986,262144 /prefetch:8
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 536
            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe"Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /fJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,15013827744706186800,13121207676491278986,262144 /prefetch:8
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: version.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: wldp.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: profapi.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: riched20.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: usp10.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: msls31.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: amsi.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: userenv.dllJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: webio.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: dlnashext.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wpdshext.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: mscoree.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: apphelp.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: kernel.appcore.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: version.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: uxtheme.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: windows.storage.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: wldp.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: profapi.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: rsaenh.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: dwrite.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: textshaping.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: amsi.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: userenv.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: ntmarta.dll
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeSection loaded: sspicli.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wininet.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: mscoree.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: apphelp.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: kernel.appcore.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: version.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: uxtheme.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: windows.storage.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: wldp.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: profapi.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: cryptsp.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: rsaenh.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: cryptbase.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: dwrite.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: textshaping.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: amsi.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: userenv.dll
            Source: C:\ProgramData\yIVKiWQb\Application.exeSection loaded: sspicli.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: wininet.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeSection loaded: kernel.appcore.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: apphelp.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: rsaenh.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: jmpfupbgfijqosepwbnu.dll
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: rsaenh.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: jmpfupbgfijqosepwbnu.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: rsaenh.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: jmpfupbgfijqosepwbnu.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptsp.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: rsaenh.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\service123.exeSection loaded: jmpfupbgfijqosepwbnu.dll
            Source: C:\Users\user\Desktop\DMv89K955Y.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: DMv89K955Y.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: DMv89K955Y.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: DMv89K955Y.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

            Data Obfuscation

            barindex
            .NET source code contains potential unpacker
            Source: 0.2.DMv89K955Y.exe.132d1a78.1.raw.unpack, searchX64LPVOIDhierarchy.cs.Net Code: WaitDelegatesetLatencyMode
            Source: 0.2.DMv89K955Y.exe.1d4e0000.2.raw.unpack, searchX64LPVOIDhierarchy.cs.Net Code: WaitDelegatesetLatencyMode
            Source: 0.0.DMv89K955Y.exe.e3408e.1.raw.unpack, searchX64LPVOIDhierarchy.cs.Net Code: WaitDelegatesetLatencyMode
            Source: DMv89K955Y.exeStatic PE information: 0x9C4597AB [Wed Jan 29 23:35:07 2053 UTC]
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007681E0 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,FreeLibrary,30_2_007681E0
            Source: c[1].exe.5.drStatic PE information: section name: .00cfg
            Source: c[1].exe.5.drStatic PE information: section name: .back
            Source: c.exe.5.drStatic PE information: section name: .00cfg
            Source: c.exe.5.drStatic PE information: section name: .back
            Source: 5[1].exe.5.drStatic PE information: section name: .eh_fram
            Source: 5.exe.5.drStatic PE information: section name: .eh_fram
            Source: C:\Users\user\Desktop\DMv89K955Y.exeCode function: 0_2_00007FFD34696CEE push eax; retn FFFFh0_2_00007FFD34696FCD
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004F7D70 push eax; ret 8_2_004F7F3D
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051AD4E push ecx; ret 8_2_0051AD61
            Source: C:\ProgramData\LgAmARwZ\Application.exeCode function: 11_2_00007FFD34696CEE push eax; retn FFFFh11_2_00007FFD34696FCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042A621 push ecx; ret 13_2_0042A634
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00416B39 pushad ; retf 13_2_00416B3D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00416C47 push edx; retf 0000h13_2_00416C4B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00416C71 push ss; retf 0000h13_2_00416C87
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0044AEB8 push ecx; ret 14_2_0044AEB9
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051AD4E push ecx; ret 14_2_0051AD61
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004F7D70 push eax; ret 14_2_004F7F3D
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeCode function: 19_2_00007FFD34656FD6 push esp; iretd 19_2_00007FFD34656FD9
            Source: C:\ProgramData\yIVKiWQb\Application.exeCode function: 21_2_00007FFD34696FD6 push esp; iretd 21_2_00007FFD34696FD9
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_0076A521 push es; iretd 30_2_0076A694
            Source: DMv89K955Y.exeStatic PE information: section name: .text entropy: 7.82060659626259
            Source: Application.exe.0.drStatic PE information: section name: .text entropy: 7.82060659626259
            Source: c[1].exe.5.drStatic PE information: section name: .text entropy: 7.081413479421207
            Source: c.exe.5.drStatic PE information: section name: .text entropy: 7.081413479421207
            Source: random[1].exe.5.drStatic PE information: section name: .text entropy: 7.561309053948209
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\10000610101\5.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeFile created: C:\ProgramData\yIVKiWQb\Application.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\10000600101\c.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\5[1].exeJump to dropped file
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile created: C:\ProgramData\LgAmARwZ\Application.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeFile created: C:\ProgramData\yIVKiWQb\Application.exeJump to dropped file
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile created: C:\ProgramData\LgAmARwZ\Application.exeJump to dropped file

            Boot Survival

            barindex
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.urlJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.urlJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yIVKiWQb.url
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051AD82 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,8_2_0051AD82
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Query firmware table information (likely to detect VMs)
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeSystem information queried: FirmwareTableInformationJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory allocated: 15F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory allocated: 1B2C0000 memory reserve | memory write watchJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory allocated: 12A0000 memory reserve | memory write watchJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory allocated: 1AEB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory allocated: C20000 memory reserve | memory write watch
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory allocated: 1A7B0000 memory reserve | memory write watch
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory allocated: F80000 memory reserve | memory write watch
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory allocated: 1AC00000 memory reserve | memory write watch
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 180000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeThread delayed: delay time: 922337203685477
            Source: C:\ProgramData\yIVKiWQb\Application.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\AppData\Local\Temp\service123.exeWindow / User API: threadDelayed 3737
            Source: C:\Users\user\AppData\Local\Temp\service123.exeWindow / User API: threadDelayed 5287
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI coverage: 2.5 %
            Source: C:\Users\user\AppData\Local\Temp\service123.exeAPI coverage: 4.2 %
            Source: C:\Users\user\Desktop\DMv89K955Y.exe TID: 2672Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5268Thread sleep time: -4560000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6108Thread sleep time: -720000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5268Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exe TID: 5328Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exe TID: 6648Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exe TID: 2128Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe TID: 1396Thread sleep time: -922337203685477s >= -30000s
            Source: C:\ProgramData\yIVKiWQb\Application.exe TID: 5072Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 6916Thread sleep count: 3737 > 30
            Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 6916Thread sleep time: -373700s >= -30000s
            Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 6916Thread sleep count: 5287 > 30
            Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 6916Thread sleep time: -528700s >= -30000s
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\AppData\Local\Temp\service123.exeLast function: Thread delayed
            Source: C:\Users\user\AppData\Local\Temp\service123.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005262C7 FindFirstFileExW,8_2_005262C7
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00526378 FindFirstFileExW,FindNextFileW,FindClose,FindClose,8_2_00526378
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043F371 FindFirstFileExW,13_2_0043F371
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_005262C7 FindFirstFileExW,14_2_005262C7
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00526378 FindFirstFileExW,FindNextFileW,FindClose,FindClose,14_2_00526378
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004093D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,13_2_004093D0
            Source: C:\Users\user\Desktop\DMv89K955Y.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 30000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 180000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 30000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeThread delayed: delay time: 922337203685477
            Source: C:\ProgramData\yIVKiWQb\Application.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
            Source: Amcache.hve.17.drBinary or memory string: VMware
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
            Source: Amcache.hve.17.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
            Source: c.exe, 0000000E.00000003.3151725105.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153159020.00000000027BC000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.00000000027BC000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153289392.0000000002800000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
            Source: Amcache.hve.17.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
            Source: Amcache.hve.17.drBinary or memory string: vmci.sys
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
            Source: Amcache.hve.17.drBinary or memory string: VMware20,1
            Source: Amcache.hve.17.drBinary or memory string: Microsoft Hyper-V Generation Counter
            Source: Amcache.hve.17.drBinary or memory string: NECVMWar VMware SATA CD00
            Source: Amcache.hve.17.drBinary or memory string: VMware Virtual disk SCSI Disk Device
            Source: Amcache.hve.17.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
            Source: Amcache.hve.17.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
            Source: Amcache.hve.17.drBinary or memory string: VMware PCI VMCI Bus Device
            Source: Amcache.hve.17.drBinary or memory string: VMware VMCI Bus Device
            Source: Amcache.hve.17.drBinary or memory string: VMware Virtual RAM
            Source: Amcache.hve.17.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
            Source: Amcache.hve.17.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
            Source: Amcache.hve.17.drBinary or memory string: VMware Virtual USB Mouse
            Source: Amcache.hve.17.drBinary or memory string: vmci.syshbin
            Source: Amcache.hve.17.drBinary or memory string: VMware, Inc.
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
            Source: Amcache.hve.17.drBinary or memory string: VMware20,1hbin@
            Source: Amcache.hve.17.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
            Source: Amcache.hve.17.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.17.drBinary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
            Source: Amcache.hve.17.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
            Source: c.exe, 0000000E.00000003.3032301384.0000000005017000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: - GDCDYNVMware20,11696487552p
            Source: Amcache.hve.17.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.17.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
            Source: 5.exe, 00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmp, 5.exe, 00000012.00000002.4184393887.000000000097E000.00000004.00000020.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3342970416.0000000000A02000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3396738119.000001AD8E41C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
            Source: Amcache.hve.17.drBinary or memory string: vmci.syshbin`
            Source: Amcache.hve.17.drBinary or memory string: \driver\vmci,\driver\pci
            Source: Amcache.hve.17.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
            Source: Amcache.hve.17.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
            Source: 5.exe, 00000012.00000003.3416342649.0000000003EB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_00440D90 LdrInitializeThunk,14_2_00440D90
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051FB9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0051FB9A
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007681E0 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,FreeLibrary,30_2_007681E0
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005391B4 mov edi, dword ptr fs:[00000030h]8_2_005391B4
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_004F7D70 mov edi, dword ptr fs:[00000030h]8_2_004F7D70
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042E1C0 mov eax, dword ptr fs:[00000030h]13_2_0042E1C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004363B2 mov eax, dword ptr fs:[00000030h]13_2_004363B2
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_004F7D70 mov edi, dword ptr fs:[00000030h]14_2_004F7D70
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_00522900 GetProcessHeap,8_2_00522900
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess token adjusted: Debug
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051FB9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0051FB9A
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051AC62 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_0051AC62
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051B644 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0051B644
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051B638 SetUnhandledExceptionFilter,8_2_0051B638
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042A805 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_0042A805
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042A968 SetUnhandledExceptionFilter,13_2_0042A968
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0042EEE9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_0042EEE9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_00429F18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_00429F18
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051FB9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_0051FB9A
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051AC62 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0051AC62
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051B644 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_0051B644
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 14_2_0051B638 SetUnhandledExceptionFilter,14_2_0051B638
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_0076116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,30_2_0076116C
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_00761160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,30_2_00761160
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007611A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,30_2_007611A3
            Source: C:\Users\user\AppData\Local\Temp\service123.exeCode function: 30_2_007613C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,30_2_007613C9
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Allocates memory in foreign processes
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
            Contains functionality to inject code into remote processes
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_005391B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,8_2_005391B4
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeMemory written: C:\Users\user\AppData\Local\Temp\10000600101\c.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
            LummaC encrypted strings found
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: servicedny.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: authorisev.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: faulteyotk.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: dilemmadu.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: contemteny.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: goalyfeastz.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: opposezmny.site
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: seallysl.site
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 451000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 466000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46D000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46E000Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CDC008Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 451000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 466000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46D000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46E000Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B87008Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 451000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 466000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46D000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46E000
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D55008
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 451000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 466000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46D000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46E000
            Source: C:\ProgramData\yIVKiWQb\Application.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 111B008
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeProcess created: C:\Users\user\AppData\Local\Temp\10000600101\c.exe "C:\Users\user\AppData\Local\Temp\10000600101\c.exe"Jump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /fJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: C:\ProgramData\yIVKiWQb\Application.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051B3FD cpuid 8_2_0051B3FD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,13_2_00442226
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,13_2_004424C8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,13_2_0043857F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,13_2_00442513
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,13_2_004425AE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,13_2_00442639
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,13_2_0044288C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,13_2_004429B2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,13_2_00438AA1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,13_2_00442AB8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,13_2_00442B87
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeQueries volume information: C:\Users\user\Desktop\DMv89K955Y.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\DMv89K955Y.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\10000600101\c.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\10000600101\c.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformationJump to behavior
            Source: C:\ProgramData\LgAmARwZ\Application.exeQueries volume information: C:\ProgramData\LgAmARwZ\Application.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exeQueries volume information: C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe VolumeInformation
            Source: C:\ProgramData\yIVKiWQb\Application.exeQueries volume information: C:\ProgramData\yIVKiWQb\Application.exe VolumeInformation
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeCode function: 8_2_0051BAC5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,8_2_0051BAC5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004061F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,13_2_004061F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_0043EA8E _free,_free,_free,GetTimeZoneInformation,_free,13_2_0043EA8E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 13_2_004093D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,13_2_004093D0
            Source: C:\Users\user\Desktop\DMv89K955Y.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: Amcache.hve.17.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
            Source: Amcache.hve.17.drBinary or memory string: msmpeng.exe
            Source: Amcache.hve.17.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
            Source: Amcache.hve.17.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
            Source: c.exe, 0000000E.00000003.3103777527.000000000286E000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3155076068.0000000004FBA000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103182664.000000000286D000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3107301176.0000000002871000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
            Source: Amcache.hve.17.drBinary or memory string: MsMpEng.exe
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

            Stealing of Sensitive Information

            barindex
            Yara detected Clipboard Hijacker
            Source: Yara matchFile source: 00000012.00000003.4130683296.0000000001359000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 5.exe PID: 6360, type: MEMORYSTR
            Yara detected Cryptbot
            Source: Yara matchFile source: 00000012.00000003.3440249875.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000003.3440479974.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 5.exe PID: 6360, type: MEMORYSTR
            Yara detected LummaC Stealer
            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: c.exe PID: 6892, type: MEMORYSTR
            Found many strings related to Crypto-Wallets (likely being stolen)
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/Electrum
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/ElectronCash
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
            Source: c.exe, 00000008.00000002.3013319976.0000000002A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: LD4nST--Exodus
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
            Source: c.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ":["keystore"],"z":"Wall
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.jsonJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfeJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihdJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.dbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchhJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihohJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbicJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilcJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofecJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimnJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgppJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpiJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmjJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoaddJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaadJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclgJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdafJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapacJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpakJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbgJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgkJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgnJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnfJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahdJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhkJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohaoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfddJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkdJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdnoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcobJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeapJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjhJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaocJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcjeJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolafJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfjJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemgJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfciJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.jsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappaflnJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhaeJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjehJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqliteJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkldJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqliteJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjkJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdphJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnknoJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneecJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For AccountJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffneJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklkJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdmaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflcJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncgJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgefJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhadJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdilJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcgeJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimigJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmonJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnidJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjihJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliofJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhiJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkpJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnbaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcelljJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.dbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopgJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbnJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbmJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafaJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgikJump to behavior
            Tries to steal Crypto Currency Wallets
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Ledger LiveJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Ledger LiveJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\BinanceJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\BinanceJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDBJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\walletsJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDBJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDBJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQLJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQLJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\GIGIYTFFYTJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\GIGIYTFFYTJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\PWCCAWLGREJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\PWCCAWLGREJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\QCFWYSKMHAJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\QCFWYSKMHAJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOPJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\10000600101\c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOPJump to behavior
            Source: Yara matchFile source: 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.3079021722.000000000285F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.3079043172.0000000002865000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: c.exe PID: 6892, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 5.exe PID: 6360, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Attempt to bypass Chrome Application-Bound Encryption
            Source: C:\Users\user\AppData\Local\Temp\10000610101\5.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
            Yara detected Cryptbot
            Source: Yara matchFile source: 00000012.00000003.3440249875.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000003.3440479974.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 5.exe PID: 6360, type: MEMORYSTR
            Yara detected LummaC Stealer
            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: c.exe PID: 6892, type: MEMORYSTR
            Contains functionality to start a terminal service
            Source: DMv89K955Y.exe, 00000000.00000002.2558935359.00000000032C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: net start termservice
            Source: DMv89K955Y.exe, 00000000.00000002.2558935359.00000000032C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set9808a67f01d2f0720518035acbde7521c1ec479e5342a25940592acf24703eb27c43933a6df6cc301ccfdb96c295ca9e1379cdKQ6YLeECCI7oRIIlBdu0JXCschRUJvTmfL1bOR7r2ybwLPTtMr==SvPibCQyHPQpdL==JPKpdL==XgagNuVoBJ1TRp==WZYvZSx5AcYV4F==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyPWW XN==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy VSJq29EKfvRj1wrD1Urk1YMDS0GeciN62q==SjKqWZQhIx5IxvMEWthJxwZwAVygSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyakKrZBtxBpL8SEysZYFm1NP=SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy UXdq1wz8Wb5jOALv2o==HSKQRQFVJabxXJtwyK==VButcv==SBYQVv==PXKR9TF3bkB3aZF3 0B3Wj 3WUx3aDB3bTT3XDP3WUN3 EN3 Z23agP=W0yiZx1p1wAZ3Rtg2wVh1yr8W0yiZx1p1wz=WZmmcx1p1wz=XAt=XQt=XQx=XQB=RTumbb==9EGXcykAAm==9EGXcCIaAoa=XU7iXDmpWZQhaEBu UCmcjatJ0uYaRR5NDB+NDF+JYqpdR u1dPmIvhoGt==dx==HkKraSMdNN==aZ7ibBsEB98bgvs=9ZKvbhRxBpLl4vtjPZKXThB50N2cZShq3ALqHOZmdx==SEysZYFm1KU9ivB4OSOyUWMlJSbdiw 92gK=OUOmchA=QZuwcBRD2SwWNtt9Na==PSCCVv==SDurZBAlJSYaiMFg3Ba=PDYgdB5Dxvgc36==OSOEKwNtVB55NMAK4LJS2gbX4I==OjaXZBRrOM8b4ME=RjYvdB5zSZYtaB5EOZYqbXNATZarRBRrOM8b4ME=KAtvMuM6C fVTF==ajx=bZx=OZYrdBRz3s4LjMxcDcrq3Or0cYEl9hHlXjYvbNXpNNU9Tnx 1XLrOyzygU3xHMRjJPPqLNWyBNeAbX15OM8RQJNg2Xrs2Uf0cXbyKcsc 0yqLRNm3wHYNv191QK6xeLhfHHmKssc9TmibhByOJ3 GdPHQX5z3wYlirXL4RriDavheIEw7QE8bDasbd5ANTUcirXq3BziNOUNEh3OBNdqLNWyAI3=JPPKCb==N0CgceWCJjetZr==OZYrdBRz3s4LjMxcDcre2zvscXQl Acl fY1LS 83o4dgSFkARLv1yPu03boVQH=SYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA4VR5k2BLXOPDO0X4pTyEl UqYdBRDIcIk4F==OZYqcCR5ONMF3LXcWTygZBRrOSkgfbpj1QVs2zzye4U5 h5UcUdtMOEECtXTSocWAPY=JUKraRJAOwXkSYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA40L1g3ALhKefk1XbgMU0ETCyMTAt1HKUwYQs=SYaQVzRSMuQmgcNp1WnQOPKwOEIgQWMobjagZSJhFcIqfLJv0RDt1yz5ZG2tVAMlTjahZR5OGq==VAptMyw=PDKjYSRx3vQciwNg1g4wAdbS1YQz8BMQ9TYrPDKjYSRx3vQciwNg1g4wAdfS1YQz8BMQ9TYrSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0BdTgNhFTYphbRl3zPi2fHpd37=SEysZCRo3u89gLQ=KgpuOL==KgpvMb==KgpuNb==KgpvNL==O0KvchRz3uMSfLtbVx==Mgd3akKrZBtxBpLl4MdcJZhdGkGecXpw0MAjNr5dxwZm1KuiGfpjJdx50M4cgSRRxxudyaSg1HYwEu==HfNdRSdu3sL=GfpjJdxDOM78GzNjIv==SDY0ZSFE0wYjgr1c4AK=JTK1ZRJ63womgcxm1Abg4Kvy1X4z AMp9T3rZRMlAK2ggvQ8xa==Gd==aZ7YdBNA3S78QMI8ARGdBs==a0F6cr==ajurZB5yQZK2Yh5m2cT8YvBW1XLXMxvy1XAzUQH=KAptMyw5BJn=KAptMyw5B L=KAptMyw5B P=KAptMyw5BS1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
            Source: Application.exe, 0000000B.00000002.2993199415.0000000002EB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: net start termservice
            Source: Application.exe, 0000000B.00000002.2993199415.0000000002EB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set9808a67f01d2f0720518035acbde7521c1ec479e5342a25940592acf24703eb27c43933a6df6cc301ccfdb96c295ca9e1379cdKQ6YLeECCI7oRIIlBdu0JXCschRUJvTmfL1bOR7r2ybwLPTtMr==SvPibCQyHPQpdL==JPKpdL==XgagNuVoBJ1TRp==WZYvZSx5AcYV4F==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyPWW XN==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy VSJq29EKfvRj1wrD1Urk1YMDS0GeciN62q==SjKqWZQhIx5IxvMEWthJxwZwAVygSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyakKrZBtxBpL8SEysZYFm1NP=SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy UXdq1wz8Wb5jOALv2o==HSKQRQFVJabxXJtwyK==VButcv==SBYQVv==PXKR9TF3bkB3aZF3 0B3Wj 3WUx3aDB3bTT3XDP3WUN3 EN3 Z23agP=W0yiZx1p1wAZ3Rtg2wVh1yr8W0yiZx1p1wz=WZmmcx1p1wz=XAt=XQt=XQx=XQB=RTumbb==9EGXcykAAm==9EGXcCIaAoa=XU7iXDmpWZQhaEBu UCmcjatJ0uYaRR5NDB+NDF+JYqpdR u1dPmIvhoGt==dx==HkKraSMdNN==aZ7ibBsEB98bgvs=9ZKvbhRxBpLl4vtjPZKXThB50N2cZShq3ALqHOZmdx==SEysZYFm1KU9ivB4OSOyUWMlJSbdiw 92gK=OUOmchA=QZuwcBRD2SwWNtt9Na==PSCCVv==SDurZBAlJSYaiMFg3Ba=PDYgdB5Dxvgc36==OSOEKwNtVB55NMAK4LJS2gbX4I==OjaXZBRrOM8b4ME=RjYvdB5zSZYtaB5EOZYqbXNATZarRBRrOM8b4ME=KAtvMuM6C fVTF==ajx=bZx=OZYrdBRz3s4LjMxcDcrq3Or0cYEl9hHlXjYvbNXpNNU9Tnx 1XLrOyzygU3xHMRjJPPqLNWyBNeAbX15OM8RQJNg2Xrs2Uf0cXbyKcsc 0yqLRNm3wHYNv191QK6xeLhfHHmKssc9TmibhByOJ3 GdPHQX5z3wYlirXL4RriDavheIEw7QE8bDasbd5ANTUcirXq3BziNOUNEh3OBNdqLNWyAI3=JPPKCb==N0CgceWCJjetZr==OZYrdBRz3s4LjMxcDcre2zvscXQl Acl fY1LS 83o4dgSFkARLv1yPu03boVQH=SYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA4VR5k2BLXOPDO0X4pTyEl UqYdBRDIcIk4F==OZYqcCR5ONMF3LXcWTygZBRrOSkgfbpj1QVs2zzye4U5 h5UcUdtMOEECtXTSocWAPY=JUKraRJAOwXkSYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA40L1g3ALhKefk1XbgMU0ETCyMTAt1HKUwYQs=SYaQVzRSMuQmgcNp1WnQOPKwOEIgQWMobjagZSJhFcIqfLJv0RDt1yz5ZG2tVAMlTjahZR5OGq==VAptMyw=PDKjYSRx3vQciwNg1g4wAdbS1YQz8BMQ9TYrPDKjYSRx3vQciwNg1g4wAdfS1YQz8BMQ9TYrSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0BdTgNhFTYphbRl3zPi2fHpd37=SEysZCRo3u89gLQ=KgpuOL==KgpvMb==KgpuNb==KgpvNL==O0KvchRz3uMSfLtbVx==Mgd3akKrZBtxBpLl4MdcJZhdGkGecXpw0MAjNr5dxwZm1KuiGfpjJdx50M4cgSRRxxudyaSg1HYwEu==HfNdRSdu3sL=GfpjJdxDOM78GzNjIv==SDY0ZSFE0wYjgr1c4AK=JTK1ZRJ63womgcxm1Abg4Kvy1X4z AMp9T3rZRMlAK2ggvQ8xa==Gd==aZ7YdBNA3S78QMI8ARGdBs==a0F6cr==ajurZB5yQZK2Yh5m2cT8YvBW1XLXMxvy1XAzUQH=KAptMyw5BJn=KAptMyw5B L=KAptMyw5B P=KAptMyw5BS1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
            Source: RegAsm.exeString found in binary or memory: net start termservice
            Source: RegAsm.exe, 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: net start termservice
            Source: RegAsm.exe, 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set9808a67f01d2f0720518035acbde7521c1ec479e5342a25940592acf24703eb27c43933a6df6cc301ccfdb96c295ca9e1379cdKQ6YLeECCI7oRIIlBdu0JXCschRUJvTmfL1bOR7r2ybwLPTtMr==SvPibCQyHPQpdL==JPKpdL==XgagNuVoBJ1TRp==WZYvZSx5AcYV4F==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyPWW XN==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy VSJq29EKfvRj1wrD1Urk1YMDS0GeciN62q==SjKqWZQhIx5IxvMEWthJxwZwAVygSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyakKrZBtxBpL8SEysZYFm1NP=SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy UXdq1wz8Wb5jOALv2o==HSKQRQFVJabxXJtwyK==VButcv==SBYQVv==PXKR9TF3bkB3aZF3 0B3Wj 3WUx3aDB3bTT3XDP3WUN3 EN3 Z23agP=W0yiZx1p1wAZ3Rtg2wVh1yr8W0yiZx1p1wz=WZmmcx1p1wz=XAt=XQt=XQx=XQB=RTumbb==9EGXcykAAm==9EGXcCIaAoa=XU7iXDmpWZQhaEBu UCmcjatJ0uYaRR5NDB+NDF+JYqpdR u1dPmIvhoGt==dx==HkKraSMdNN==aZ7ibBsEB98bgvs=9ZKvbhRxBpLl4vtjPZKXThB50N2cZShq3ALqHOZmdx==SEysZYFm1KU9ivB4OSOyUWMlJSbdiw 92gK=OUOmchA=QZuwcBRD2SwWNtt9Na==PSCCVv==SDurZBAlJSYaiMFg3Ba=PDYgdB5Dxvgc36==OSOEKwNtVB55NMAK4LJS2gbX4I==OjaXZBRrOM8b4ME=RjYvdB5zSZYtaB5EOZYqbXNATZarRBRrOM8b4ME=KAtvMuM6C fVTF==ajx=bZx=OZYrdBRz3s4LjMxcDcrq3Or0cYEl9hHlXjYvbNXpNNU9Tnx 1XLrOyzygU3xHMRjJPPqLNWyBNeAbX15OM8RQJNg2Xrs2Uf0cXbyKcsc 0yqLRNm3wHYNv191QK6xeLhfHHmKssc9TmibhByOJ3 GdPHQX5z3wYlirXL4RriDavheIEw7QE8bDasbd5ANTUcirXq3BziNOUNEh3OBNdqLNWyAI3=JPPKCb==N0CgceWCJjetZr==OZYrdBRz3s4LjMxcDcre2zvscXQl Acl fY1LS 83o4dgSFkARLv1yPu03boVQH=SYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA4VR5k2BLXOPDO0X4pTyEl UqYdBRDIcIk4F==OZYqcCR5ONMF3LXcWTygZBRrOSkgfbpj1QVs2zzye4U5 h5UcUdtMOEECtXTSocWAPY=JUKraRJAOwXkSYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA40L1g3ALhKefk1XbgMU0ETCyMTAt1HKUwYQs=SYaQVzRSMuQmgcNp1WnQOPKwOEIgQWMobjagZSJhFcIqfLJv0RDt1yz5ZG2tVAMlTjahZR5OGq==VAptMyw=PDKjYSRx3vQciwNg1g4wAdbS1YQz8BMQ9TYrPDKjYSRx3vQciwNg1g4wAdfS1YQz8BMQ9TYrSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0BdTgNhFTYphbRl3zPi2fHpd37=SEysZCRo3u89gLQ=KgpuOL==KgpvMb==KgpuNb==KgpvNL==O0KvchRz3uMSfLtbVx==Mgd3akKrZBtxBpLl4MdcJZhdGkGecXpw0MAjNr5dxwZm1KuiGfpjJdx50M4cgSRRxxudyaSg1HYwEu==HfNdRSdu3sL=GfpjJdxDOM78GzNjIv==SDY0ZSFE0wYjgr1c4AK=JTK1ZRJ63womgcxm1Abg4Kvy1X4z AMp9T3rZRMlAK2ggvQ8xa==Gd==aZ7YdBNA3S78QMI8ARGdBs==a0F6cr==ajurZB5yQZK2Yh5m2cT8YvBW1XLXMxvy1XAzUQH=KAptMyw5BJn=KAptMyw5B L=KAptMyw5B P=KAptMyw5BS1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
            Source: 449e940ceb.exe, 00000013.00000002.3231521051.00000000028A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: net start termservice
            Source: 449e940ceb.exe, 00000013.00000002.3231521051.00000000028A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set9808a67f01d2f0720518035acbde7521c1ec479e5342a25940592acf24703eb27c43933a6df6cc301ccfdb96c295ca9e1379cdKQ6YLeECCI7oRIIlBdu0JXCschRUJvTmfL1bOR7r2ybwLPTtMr==SvPibCQyHPQpdL==JPKpdL==XgagNuVoBJ1TRp==WZYvZSx5AcYV4F==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyPWW XN==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy VSJq29EKfvRj1wrD1Urk1YMDS0GeciN62q==SjKqWZQhIx5IxvMEWthJxwZwAVygSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyakKrZBtxBpL8SEysZYFm1NP=SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy UXdq1wz8Wb5jOALv2o==HSKQRQFVJabxXJtwyK==VButcv==SBYQVv==PXKR9TF3bkB3aZF3 0B3Wj 3WUx3aDB3bTT3XDP3WUN3 EN3 Z23agP=W0yiZx1p1wAZ3Rtg2wVh1yr8W0yiZx1p1wz=WZmmcx1p1wz=XAt=XQt=XQx=XQB=RTumbb==9EGXcykAAm==9EGXcCIaAoa=XU7iXDmpWZQhaEBu UCmcjatJ0uYaRR5NDB+NDF+JYqpdR u1dPmIvhoGt==dx==HkKraSMdNN==aZ7ibBsEB98bgvs=9ZKvbhRxBpLl4vtjPZKXThB50N2cZShq3ALqHOZmdx==SEysZYFm1KU9ivB4OSOyUWMlJSbdiw 92gK=OUOmchA=QZuwcBRD2SwWNtt9Na==PSCCVv==SDurZBAlJSYaiMFg3Ba=PDYgdB5Dxvgc36==OSOEKwNtVB55NMAK4LJS2gbX4I==OjaXZBRrOM8b4ME=RjYvdB5zSZYtaB5EOZYqbXNATZarRBRrOM8b4ME=KAtvMuM6C fVTF==ajx=bZx=OZYrdBRz3s4LjMxcDcrq3Or0cYEl9hHlXjYvbNXpNNU9Tnx 1XLrOyzygU3xHMRjJPPqLNWyBNeAbX15OM8RQJNg2Xrs2Uf0cXbyKcsc 0yqLRNm3wHYNv191QK6xeLhfHHmKssc9TmibhByOJ3 GdPHQX5z3wYlirXL4RriDavheIEw7QE8bDasbd5ANTUcirXq3BziNOUNEh3OBNdqLNWyAI3=JPPKCb==N0CgceWCJjetZr==OZYrdBRz3s4LjMxcDcre2zvscXQl Acl fY1LS 83o4dgSFkARLv1yPu03boVQH=SYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA4VR5k2BLXOPDO0X4pTyEl UqYdBRDIcIk4F==OZYqcCR5ONMF3LXcWTygZBRrOSkgfbpj1QVs2zzye4U5 h5UcUdtMOEECtXTSocWAPY=JUKraRJAOwXkSYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA40L1g3ALhKefk1XbgMU0ETCyMTAt1HKUwYQs=SYaQVzRSMuQmgcNp1WnQOPKwOEIgQWMobjagZSJhFcIqfLJv0RDt1yz5ZG2tVAMlTjahZR5OGq==VAptMyw=PDKjYSRx3vQciwNg1g4wAdbS1YQz8BMQ9TYrPDKjYSRx3vQciwNg1g4wAdfS1YQz8BMQ9TYrSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0BdTgNhFTYphbRl3zPi2fHpd37=SEysZCRo3u89gLQ=KgpuOL==KgpvMb==KgpuNb==KgpvNL==O0KvchRz3uMSfLtbVx==Mgd3akKrZBtxBpLl4MdcJZhdGkGecXpw0MAjNr5dxwZm1KuiGfpjJdx50M4cgSRRxxudyaSg1HYwEu==HfNdRSdu3sL=GfpjJdxDOM78GzNjIv==SDY0ZSFE0wYjgr1c4AK=JTK1ZRJ63womgcxm1Abg4Kvy1X4z AMp9T3rZRMlAK2ggvQ8xa==Gd==aZ7YdBNA3S78QMI8ARGdBs==a0F6cr==ajurZB5yQZK2Yh5m2cT8YvBW1XLXMxvy1XAzUQH=KAptMyw5BJn=KAptMyw5B L=KAptMyw5B P=KAptMyw5BS1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
            Source: Application.exe, 00000015.00000002.3374587211.0000000002C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: net start termservice
            Source: Application.exe, 00000015.00000002.3374587211.0000000002C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set9808a67f01d2f0720518035acbde7521c1ec479e5342a25940592acf24703eb27c43933a6df6cc301ccfdb96c295ca9e1379cdKQ6YLeECCI7oRIIlBdu0JXCschRUJvTmfL1bOR7r2ybwLPTtMr==SvPibCQyHPQpdL==JPKpdL==XgagNuVoBJ1TRp==WZYvZSx5AcYV4F==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyPWW XN==SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy VSJq29EKfvRj1wrD1Urk1YMDS0GeciN62q==SjKqWZQhIx5IxvMEWthJxwZwAVygSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcWoYyakKrZBtxBpL8SEysZYFm1NP=SXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0C QYRD2cYliuVc2hDm1UZcTYkA8A0oXUy UXdq1wz8Wb5jOALv2o==HSKQRQFVJabxXJtwyK==VButcv==SBYQVv==PXKR9TF3bkB3aZF3 0B3Wj 3WUx3aDB3bTT3XDP3WUN3 EN3 Z23agP=W0yiZx1p1wAZ3Rtg2wVh1yr8W0yiZx1p1wz=WZmmcx1p1wz=XAt=XQt=XQx=XQB=RTumbb==9EGXcykAAm==9EGXcCIaAoa=XU7iXDmpWZQhaEBu UCmcjatJ0uYaRR5NDB+NDF+JYqpdR u1dPmIvhoGt==dx==HkKraSMdNN==aZ7ibBsEB98bgvs=9ZKvbhRxBpLl4vtjPZKXThB50N2cZShq3ALqHOZmdx==SEysZYFm1KU9ivB4OSOyUWMlJSbdiw 92gK=OUOmchA=QZuwcBRD2SwWNtt9Na==PSCCVv==SDurZBAlJSYaiMFg3Ba=PDYgdB5Dxvgc36==OSOEKwNtVB55NMAK4LJS2gbX4I==OjaXZBRrOM8b4ME=RjYvdB5zSZYtaB5EOZYqbXNATZarRBRrOM8b4ME=KAtvMuM6C fVTF==ajx=bZx=OZYrdBRz3s4LjMxcDcrq3Or0cYEl9hHlXjYvbNXpNNU9Tnx 1XLrOyzygU3xHMRjJPPqLNWyBNeAbX15OM8RQJNg2Xrs2Uf0cXbyKcsc 0yqLRNm3wHYNv191QK6xeLhfHHmKssc9TmibhByOJ3 GdPHQX5z3wYlirXL4RriDavheIEw7QE8bDasbd5ANTUcirXq3BziNOUNEh3OBNdqLNWyAI3=JPPKCb==N0CgceWCJjetZr==OZYrdBRz3s4LjMxcDcre2zvscXQl Acl fY1LS 83o4dgSFkARLv1yPu03boVQH=SYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA4VR5k2BLXOPDO0X4pTyEl UqYdBRDIcIk4F==OZYqcCR5ONMF3LXcWTygZBRrOSkgfbpj1QVs2zzye4U5 h5UcUdtMOEECtXTSocWAPY=JUKraRJAOwXkSYaQVzRSMuQShcFc1hHA1UZ0enbwQWMQVBCsbiND1SA40L1g3ALhKefk1XbgMU0ETCyMTAt1HKUwYQs=SYaQVzRSMuQmgcNp1WnQOPKwOEIgQWMobjagZSJhFcIqfLJv0RDt1yz5ZG2tVAMlTjahZR5OGq==VAptMyw=PDKjYSRx3vQciwNg1g4wAdbS1YQz8BMQ9TYrPDKjYSRx3vQciwNg1g4wAdfS1YQz8BMQ9TYrSXYDVA GJaY4YLha2gZw1UT0ZGgt8gIlb0BdTgNhFTYphbRl3zPi2fHpd37=SEysZCRo3u89gLQ=KgpuOL==KgpvMb==KgpuNb==KgpvNL==O0KvchRz3uMSfLtbVx==Mgd3akKrZBtxBpLl4MdcJZhdGkGecXpw0MAjNr5dxwZm1KuiGfpjJdx50M4cgSRRxxudyaSg1HYwEu==HfNdRSdu3sL=GfpjJdxDOM78GzNjIv==SDY0ZSFE0wYjgr1c4AK=JTK1ZRJ63womgcxm1Abg4Kvy1X4z AMp9T3rZRMlAK2ggvQ8xa==Gd==aZ7YdBNA3S78QMI8ARGdBs==a0F6cr==ajurZB5yQZK2Yh5m2cT8YvBW1XLXMxvy1XAzUQH=KAptMyw5BJn=KAptMyw5B L=KAptMyw5B P=KAptMyw5BS1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		1
            Remote Desktop Protocol            		12
            Archive Collected Data            		1
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Native API            		1
            Scheduled Task/Job            		1
            Extra Window Memory Injection            		111
            Deobfuscate/Decode Files or Information            		LSASS Memory1
            Account Discovery            		Remote Desktop Protocol31
            Data from Local System            		2
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts3
            Command and Scripting Interpreter            		2
            Registry Run Keys / Startup Folder            		411
            Process Injection            		4
            Obfuscated Files or Information            		Security Account Manager13
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Screen Capture            		1
            Remote Access Software            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal Accounts1
            Scheduled Task/Job            		Login Hook1
            Scheduled Task/Job            		13
            Software Packing            		NTDS55
            System Information Discovery            		Distributed Component Object Model2
            Clipboard Data            		1
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud Accounts1
            PowerShell            		Network Logon Script2
            Registry Run Keys / Startup Folder            		1
            Timestomp            		LSA Secrets261
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials1
            Process Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            Extra Window Memory Injection            		DCSync151
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Masquerading            		Proc Filesystem1
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt151
            Virtualization/Sandbox Evasion            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron411
            Process Injection            		Network Sniffing1
            Remote System Discovery            		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1546941 Sample: DMv89K955Y.exe Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 104 Found malware configuration 2->104 106 Antivirus detection for dropped file 2->106 108 Multi AV Scanner detection for dropped file 2->108 110 14 other signatures 2->110 9 DMv89K955Y.exe 7 2->9         started        13 Application.exe 5 2->13         started        15 Application.exe 2->15         started        17 4 other processes 2->17 process3 file4 72 C:\ProgramData\LgAmARwZ\Application.exe, PE32 9->72 dropped 74 C:\Users\user\AppData\...\LgAmARwZ.url, MS 9->74 dropped 76 C:\Users\user\AppData\...\DMv89K955Y.exe.log, CSV 9->76 dropped 78 C:\...\Application.exe:Zone.Identifier, ASCII 9->78 dropped 122 Contains functionality to start a terminal service 9->122 124 Writes to foreign memory regions 9->124 126 Allocates memory in foreign processes 9->126 19 RegAsm.exe 34 9->19         started        23 RegAsm.exe 9->23         started        128 Multi AV Scanner detection for dropped file 13->128 130 Machine Learning detection for dropped file 13->130 132 Injects a PE file into a foreign processes 13->132 25 RegAsm.exe 13->25         started        134 Antivirus detection for dropped file 15->134 28 InstallUtil.exe 15->28         started        signatures5 process6 dnsIp7 80 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 19->80 82 185.215.113.217 WHOLESALECONNECTIONSNL Portugal 19->82 84 2 other IPs or domains 19->84 64 C:\Users\user\AppData\...\449e940ceb.exe, PE32 19->64 dropped 66 C:\Users\user\AppData\Local\Temp\...\5.exe, PE32 19->66 dropped 68 C:\Users\user\AppData\Local\Temp\...\c.exe, PE32 19->68 dropped 70 3 other malicious files 19->70 dropped 30 c.exe 1 19->30         started        33 449e940ceb.exe 19->33         started        36 5.exe 5 4 19->36         started        120 Contains functionality to start a terminal service 25->120 file8 signatures9 process10 dnsIp11 136 Machine Learning detection for dropped file 30->136 138 Found many strings related to Crypto-Wallets (likely being stolen) 30->138 140 Contains functionality to inject code into remote processes 30->140 156 2 other signatures 30->156 39 c.exe 30->39         started        43 WerFault.exe 22 16 30->43         started        45 conhost.exe 30->45         started        62 C:\ProgramData\yIVKiWQb\Application.exe, PE32 33->62 dropped 142 Antivirus detection for dropped file 33->142 144 Contains functionality to start a terminal service 33->144 146 Writes to foreign memory regions 33->146 47 InstallUtil.exe 33->47         started        86 34.88.79.73 GOOGLEUS United States 36->86 88 1.1.1.1 CLOUDFLARENETUS Australia 36->88 90 127.0.0.1 unknown unknown 36->90 148 Multi AV Scanner detection for dropped file 36->148 150 Attempt to bypass Chrome Application-Bound Encryption 36->150 152 Uses schtasks.exe or at.exe to add and modify task schedules 36->152 154 Tries to harvest and steal browser information (history, passwords, etc) 36->154 49 chrome.exe 36->49         started        51 schtasks.exe 36->51         started        53 service123.exe 36->53         started        55 WerFault.exe 36->55         started        file12 signatures13 process14 dnsIp15 92 104.21.33.140 CLOUDFLARENETUS United States 39->92 112 Query firmware table information (likely to detect VMs) 39->112 114 Found many strings related to Crypto-Wallets (likely being stolen) 39->114 116 Tries to harvest and steal browser information (history, passwords, etc) 39->116 118 Tries to steal Crypto Currency Wallets 39->118 94 13.89.179.12 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 43->94 96 239.255.255.250 unknown Reserved 49->96 57 chrome.exe 49->57         started        60 conhost.exe 51->60         started        signatures16 process17 dnsIp18 98 142.250.185.100 GOOGLEUS United States 57->98 100 142.250.185.67 GOOGLEUS United States 57->100 102 2 other IPs or domains 57->102

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            DMv89K955Y.exe61%ReversingLabsWin32.Trojan.Leonem
            DMv89K955Y.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\ProgramData\yIVKiWQb\Application.exe100%AviraHEUR/AGEN.1357785
            C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe100%AviraHEUR/AGEN.1357785
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe100%AviraHEUR/AGEN.1357785
            C:\ProgramData\yIVKiWQb\Application.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Temp\10000600101\c.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].exe100%Joe Sandbox ML
            C:\ProgramData\LgAmARwZ\Application.exe100%Joe Sandbox ML
            C:\ProgramData\LgAmARwZ\Application.exe61%ReversingLabsWin32.Trojan.Leonem
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\5[1].exe46%ReversingLabsWin32.Trojan.CryptBot
            C:\Users\user\AppData\Local\Temp\10000610101\5.exe46%ReversingLabsWin32.Trojan.CryptBot

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://gcc.gnu.org/bugs/):0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            http://crl.microsoft0%URL Reputationsafe
            http://anglebug.com/46330%URL Reputationsafe
            https://anglebug.com/73820%URL Reputationsafe
            https://issuetracker.google.com/2844622630%URL Reputationsafe
            http://polymer.github.io/AUTHORS.txt0%URL Reputationsafe
            https://anglebug.com/77140%URL Reputationsafe
            http://anglebug.com/62480%URL Reputationsafe
            http://anglebug.com/69290%URL Reputationsafe
            http://anglebug.com/52810%URL Reputationsafe
            https://issuetracker.google.com/2554117480%URL Reputationsafe
            https://anglebug.com/72460%URL Reputationsafe
            https://anglebug.com/73690%URL Reputationsafe
            https://anglebug.com/74890%URL Reputationsafe
            https://drive-daily-2.corp.google.com/0%URL Reputationsafe
            http://polymer.github.io/PATENTS.txt0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://issuetracker.google.com/1619030060%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://drive-daily-1.corp.google.com/0%URL Reputationsafe
            https://drive-daily-5.corp.google.com/0%URL Reputationsafe
            http://anglebug.com/30780%URL Reputationsafe
            http://anglebug.com/75530%URL Reputationsafe
            http://anglebug.com/53750%URL Reputationsafe
            http://anglebug.com/53710%URL Reputationsafe
            http://anglebug.com/47220%URL Reputationsafe
            http://anglebug.com/75560%URL Reputationsafe
            https://chromewebstore.google.com/0%URL Reputationsafe
            https://drive-preprod.corp.google.com/0%URL Reputationsafe
            http://anglebug.com/66920%URL Reputationsafe
            https://issuetracker.google.com/2582074030%URL Reputationsafe
            http://anglebug.com/35020%URL Reputationsafe
            http://anglebug.com/36230%URL Reputationsafe
            http://anglebug.com/36250%URL Reputationsafe
            http://anglebug.com/36240%URL Reputationsafe
            http://anglebug.com/50070%URL Reputationsafe
            http://anglebug.com/38620%URL Reputationsafe
            http://anglebug.com/48360%URL Reputationsafe
            https://issuetracker.google.com/issues/1664752730%URL Reputationsafe
            http://anglebug.com/43840%URL Reputationsafe
            http://x1.c.lencr.org/00%URL Reputationsafe
            http://x1.i.lencr.org/00%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            0/80/fivejo5vt.toptrue
              		unknown
              seallysl.sitetrue
                		unknown
                analforeverlovyu.toptrue
                  		unknown
                  opposezmny.sitetrue
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://duckduckgo.com/chrome_newtabc.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://gcc.gnu.org/bugs/):5.exe, 00000012.00000003.4130683296.0000000001359000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://mail.google.com/mail/?usp=installed_webappchrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpfalse
                      		unknown
                      https://duckduckgo.com/ac/?q=c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://goalyfeastz.site/Y2c.exe, 0000000E.00000003.3008708581.0000000002857000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingchrome.exe, 00000016.00000002.3418303802.0000460000074000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          http://anglebug.com/3965=chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmpfalse
                            		unknown
                            http://crl.microsoftc.exe, 0000000E.00000003.3151538674.000000000284C000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153342354.000000000284F000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=bchrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmpfalse
                              		unknown
                              https://docs.google.com/document/Jchrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpfalse
                                		unknown
                                https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3426409662.0000460001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421407631.00004600006E0000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://anglebug.com/4633chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://anglebug.com/7382chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://issuetracker.google.com/284462263chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklychrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://polymer.github.io/AUTHORS.txtchrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://docs.google.com/chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://docs.google.com/document/:chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://photos.google.com/settings?referrer=CHROME_NTPchrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424197898.0000460000DE4000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://anglebug.com/7714chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://docs.google.com/document/u/0/create?usp=chrome_actionsAchrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://unisolated.invalid/chrome.exe, 00000016.00000002.3422619113.00004600009A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://photos.google.com?referrer=CHROME_NTPchrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424222720.0000460000DF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://www.google.com/chrome/tips/chrome.exe, 00000016.00000002.3422150149.00004600008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425288918.0000460000F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://drive.google.com/?lfhs=2chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://anglebug.com/6248chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://anglebug.com/6929chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://anglebug.com/5281chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://www.youtube.com/?feature=ytcachrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://goalyfeastz.site/c.exe, 0000000E.00000003.3140269536.0000000002866000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://issuetracker.google.com/255411748chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://docs.google.com/document/u/0/create?usp=chrome_actionschrome.exe, 00000016.00000002.3425195800.0000460000EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420631391.00004600004EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421557166.0000460000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://anglebug.com/7246chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://anglebug.com/7369chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://anglebug.com/7489chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://duckduckgo.com/?q=chrome.exe, 00000016.00000002.3421150318.0000460000628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://chrome.google.com/webstorechrome.exe, 00000016.00000002.3423726180.0000460000CC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://chrome.google.com/webstore?hl=enFchrome.exe, 00000016.00000002.3422786956.0000460000A30000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://drive-daily-2.corp.google.com/chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYic.exe, 0000000E.00000003.3062993162.0000000004FC5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://polymer.github.io/PATENTS.txtchrome.exe, 00000016.00000003.3387796831.00004600010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387028505.00004600010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422296699.000046000093F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386837306.000046000107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3433501997.0000460001180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388608168.000046000097C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3387541980.0000460000F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388919064.0000460000F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.0000460000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386984143.000046000108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388651744.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icochrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://goalyfeastz.site/apidsc.exe, 0000000E.00000002.3153404999.0000000002873000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3140232262.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3115002079.0000000002872000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103777527.000000000286E000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3103182664.000000000286D000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3107301176.0000000002871000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      http://ocsp.rootca1.amazontrust.com0:c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://issuetracker.google.com/161903006chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://ace-snapper-privately.ngrok-free.app/test/testFailed5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drfalse
                                                                          		unknown
                                                                          https://www.ecosia.org/newtab/c.exe, 0000000E.00000003.3009461607.0000000004FFB000.00000004.00000800.00020000.00000000.sdmp, 5.exe, 00000012.00000003.3415839122.0000000003EA5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423304076.0000460000B8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://drive-daily-1.corp.google.com/chrome.exe, 00000016.00000003.3378088858.00004600004D0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://drive-daily-5.corp.google.com/chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://duckduckgo.com/favicon.icochrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422116563.00004600008A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3425471477.0000460000F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421407631.00004600006E0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://anglebug.com/3078chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://anglebug.com/7553chrome.exe, 00000016.00000002.3420771216.0000460000534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://anglebug.com/5375chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://anglebug.com/5371chrome.exe, 00000016.00000002.3421590944.0000460000748000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://anglebug.com/4722chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://chrome.google.com/webstoreFchrome.exe, 00000016.00000002.3421182128.000046000063C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://m.google.com/devicemanagement/data/apichrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://chrome.google.cochrome.exe, 00000016.00000002.3418535859.0000460000130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://chrome.google.com/webstore/detail/$chrome.exe, 00000016.00000002.3425546993.0000460000FA0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 00000016.00000002.3420717729.000046000051C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3421116371.000046000060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423700407.0000460000CB4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://anglebug.com/3498Schrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://anglebug.com/7556chrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://chromewebstore.google.com/chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bFchrome.exe, 00000016.00000002.3422648362.00004600009B0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://drive-preprod.corp.google.com/chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://clients4.google.com/chrome-syncchrome.exe, 00000016.00000002.3418815466.00004600001C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://goalyfeastz.site/apiW2c.exe, 0000000E.00000003.3151538674.000000000284C000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3151268582.0000000002800000.00000004.00000020.00020000.00000000.sdmp, c.exe, 0000000E.00000002.3153342354.000000000284F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://goalyfeastz.site/pgbbc.exe, 0000000E.00000003.3060220576.0000000004FB3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://html4/loose.dtd5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drfalse
                                                                                                      		unknown
                                                                                                      http://anglebug.com/6692chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://issuetracker.google.com/258207403chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/3502chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/3623chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/3625chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/3624chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://docs.google.com/presentation/Jchrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://anglebug.com/5007chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423460295.0000460000C28000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown
                                                                                                        http://home.fivejo5vt.top/jQDBoCTTJMoxHduEQtVi175.exe.5.drfalse
                                                                                                          		unknown
                                                                                                          https://drive.google.com/drive/installwebapp?usp=chrome_defaultchrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3381870672.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419598891.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3385799702.000046000035C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422461823.0000460000988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3388347706.000046000035C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://anglebug.com/3862chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://anglebug.com/6860Fchrome.exe, 00000016.00000002.3421282495.0000460000678000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://chrome.google.com/webstoreLDDiscoverchrome.exe, 00000016.00000002.3421899681.000046000081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382240210.0000460000C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384199920.0000460000CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383968612.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423489684.0000460000C47000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3384172904.00004600004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382201875.00004600004A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419034683.00004600002A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382142539.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3424126897.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3420359901.0000460000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419879542.00004600003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382563558.0000460000C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382614897.0000460000CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3418535859.0000460000130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3382918683.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3419764691.0000460000384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3386241727.0000460000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3423726180.0000460000CC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://www.ecosia.org/search?q=&addon=opensearchchrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://anglebug.com/4836chrome.exe, 00000016.00000002.3418193334.000046000001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000002.3422756346.0000460000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  • URL Reputation: safe
                                                                                                                  		unknown
                                                                                                                  https://issuetracker.google.com/issues/166475273chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  • URL Reputation: safe
                                                                                                                  		unknown
                                                                                                                  http://.css5.exe, 00000012.00000000.3117306650.00000000010F9000.00000002.00000001.01000000.0000000E.sdmp, 5[1].exe.5.dr, 5.exe.5.drfalse
                                                                                                                    		unknown
                                                                                                                    https://ch.search.yahoo.com/favicon.icochrome.exe, 00000016.00000002.3423341972.0000460000BC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://goalyfeastz.site/apisc.exe, 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://docs.google.com/presentation/:chrome.exe, 00000016.00000002.3421702600.0000460000795000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://anglebug.com/4384chrome.exe, 00000016.00000002.3420205699.000046000041C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383053381.00004600003E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000016.00000003.3383117095.0000460000E0C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          https://goalyfeastz.site/ot7c.exe, 0000000E.00000003.3076090035.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076414351.0000000004FC6000.00000004.00000800.00020000.00000000.sdmp, c.exe, 0000000E.00000003.3076286289.0000000004FC6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://x1.c.lencr.org/0c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            http://x1.i.lencr.org/0c.exe, 0000000E.00000003.3061074839.0000000004FEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown

                                                                                                                            World Map of Contacted IPs

                                                                                                                            • No. of IPs < 25%
                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                            • 75% < No. of IPs

                                                                                                                            Public IPs

                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                            142.250.186.78
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            142.250.185.67
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            1.1.1.1
                                                                                                                            		unknownAustralia
                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                            34.88.79.73
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            13.89.179.12
                                                                                                                            		unknownUnited States
                                                                                                                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                            103.130.147.211
                                                                                                                            		unknownTurkey
                                                                                                                            		63859MYREPUBLIC-AS-IDPTEkaMasRepublikIDfalse
                                                                                                                            185.215.113.16
                                                                                                                            		unknownPortugal
                                                                                                                            		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                            142.250.185.100
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            45.149.241.37
                                                                                                                            		unknownGermany
                                                                                                                            		701UUNETUSfalse
                                                                                                                            142.251.168.84
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            239.255.255.250
                                                                                                                            		unknownReserved
                                                                                                                            		unknownunknownfalse
                                                                                                                            185.215.113.217
                                                                                                                            		unknownPortugal
                                                                                                                            		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                            104.21.33.140
                                                                                                                            		unknownUnited States
                                                                                                                            		13335CLOUDFLARENETUSfalse

                                                                                                                            Private

                                                                                                                            IP
                                                                                                                            127.0.0.1

                                                                                                                            General Information

                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                            Analysis ID:1546941
                                                                                                                            Start date and time:2024-11-01 18:13:10 +01:00
                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                            Overall analysis duration:0h 17m 30s
                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                            Report type:full
                                                                                                                            Cookbook file name:default.jbs
                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                            Number of analysed new started processes analysed:40
                                                                                                                            Number of new started drivers analysed:0
                                                                                                                            Number of existing processes analysed:0
                                                                                                                            Number of existing drivers analysed:0
                                                                                                                            Number of injected processes analysed:0
                                                                                                                            Technologies:
                                                                                                                            • HCA enabled
                                                                                                                            • EGA enabled
                                                                                                                            • AMSI enabled
                                                                                                                            Analysis Mode:default
                                                                                                                            Sample name:DMv89K955Y.exe
                                                                                                                            renamed because original name is a hash value
                                                                                                                            Original Sample Name:26d8d52bac8f4615861f39e118efa28d.exe
                                                                                                                            Detection:MAL
                                                                                                                            Classification:mal100.troj.spyw.expl.evad.winEXE@43/20@0/14
                                                                                                                            EGA Information:
                                                                                                                            • Successful, ratio: 66.7%
                                                                                                                            HCA Information:
                                                                                                                            • Successful, ratio: 59%
                                                                                                                            • Number of executed functions: 78
                                                                                                                            • Number of non-executed functions: 192
                                                                                                                            Cookbook Comments:
                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                            Warnings

                                                                                                                            • Max analysis timeout: 600s exceeded, the analysis took too long
                                                                                                                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                            • Execution Graph export aborted for target 449e940ceb.exe, PID 3360 because it is empty
                                                                                                                            • Execution Graph export aborted for target 5.exe, PID 6360 because there are no executed function
                                                                                                                            • Execution Graph export aborted for target Application.exe, PID 6228 because it is empty
                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                            • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                            • VT rate limit hit for: DMv89K955Y.exe

                                                                                                                            Simulations

                                                                                                                            Behavior and APIs

                                                                                                                            TimeTypeDescription
                                                                                                                            13:14:21API Interceptor19696599x Sleep call for process: RegAsm.exe modified
                                                                                                                            13:15:29API Interceptor10x Sleep call for process: c.exe modified
                                                                                                                            13:15:32API Interceptor2x Sleep call for process: WerFault.exe modified
                                                                                                                            13:15:52API Interceptor10x Sleep call for process: 449e940ceb.exe modified
                                                                                                                            13:16:06API Interceptor10x Sleep call for process: Application.exe modified
                                                                                                                            13:18:00API Interceptor9935920x Sleep call for process: service123.exe modified
                                                                                                                            18:14:38AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url
                                                                                                                            18:15:57AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yIVKiWQb.url
                                                                                                                            18:17:29Task SchedulerRun new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

                                                                                                                            Joe Sandbox View / Context

                                                                                                                            IPs

                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                            1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                            • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                            AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                            • 1.1.1.1/
                                                                                                                            INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                            • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                            Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                            • 1.1.1.1/
                                                                                                                            13.89.179.12faststone-capture_voLss-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                              tera10.zipGet hashmaliciousUnknownBrowse
                                                                                                                                Halkbank_Ekstre_20222501_ 073653_270424.pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                  LisectAVT_2403002C_44.exeGet hashmaliciousEICARBrowse
                                                                                                                                    CryptoService.dllGet hashmaliciousUnknownBrowse
                                                                                                                                      wechat-3.9.7-installer_ae-GFz1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                        lgX7lgUL1w.exeGet hashmaliciousNeoreklami, PureLog Stealer, SmokeLoaderBrowse
                                                                                                                                          WebReport_safe_certified_2024.zipGet hashmaliciousUnknownBrowse
                                                                                                                                            cpprest141_2_10.dllGet hashmaliciousUnknownBrowse
                                                                                                                                              DbfauspePu.exeGet hashmaliciousNeoreklamiBrowse
                                                                                                                                                103.130.147.211nJohIBtNm5.exeGet hashmaliciousLummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLineBrowse
                                                                                                                                                • 103.130.147.211/Files/2.exe
                                                                                                                                                file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211/Files/tac.exe
                                                                                                                                                file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211/Files/tac.exe
                                                                                                                                                file.exeGet hashmaliciousClipboard Hijacker, Cryptbot, Neoreklami, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211/Files/CheckTool.exe
                                                                                                                                                CSBls4grBI.exeGet hashmaliciousLummaC, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211/Files/Channel2.exe
                                                                                                                                                file.exeGet hashmaliciousAmadey, Go Injector, XWormBrowse
                                                                                                                                                • 103.130.147.211/Files/5.exe
                                                                                                                                                file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC StealerBrowse
                                                                                                                                                • 103.130.147.211/Files/tac.exe
                                                                                                                                                file.exeGet hashmaliciousAmadey, PureLog Stealer, RedLine, Stealc, zgRATBrowse
                                                                                                                                                • 103.130.147.211/Files/2.exe
                                                                                                                                                jD6b7MZOhT.exeGet hashmaliciousAmadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLineBrowse
                                                                                                                                                • 103.130.147.211/Files/2.exe
                                                                                                                                                SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exeGet hashmaliciousAmadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog StealerBrowse
                                                                                                                                                • 103.130.147.211/Files/1.exe

                                                                                                                                                Domains

                                                                                                                                                ⊘No context

                                                                                                                                                ASNs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                CLOUDFLARENETUSiIDqizT3Wx.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 104.21.33.140
                                                                                                                                                hkpqXovZtS.exeGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                • 104.26.0.231
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                • 188.114.97.3
                                                                                                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 1.1.1.1
                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 172.64.41.3
                                                                                                                                                https://issuu.com/mathildagr/docs/pmd9746827?fr=sZTMyNjc4NzAyNzMGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.24.14
                                                                                                                                                file.exeGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                • 104.26.1.231
                                                                                                                                                file.exeGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                • 104.26.1.231
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                • 188.114.96.3
                                                                                                                                                https://myabd.co.uk/main/arull.php?7080797967704b53693230746450544d6f737a6b6a4e533076544b7972566438774a38394d4841413d3d#EMAILBASE64#Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                MYREPUBLIC-AS-IDPTEkaMasRepublikIDfile.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RedLine, Stealc, VidarBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                ZnPyVAOUBc.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousAmadey, AsyncRAT, Clipboard Hijacker, Cryptbot, MicroClip, Neoreklami, RedLineBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                nJohIBtNm5.exeGet hashmaliciousLummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLineBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousClipboard Hijacker, Cryptbot, Neoreklami, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog StealerBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                CSBls4grBI.exeGet hashmaliciousLummaC, Socks5SystemzBrowse
                                                                                                                                                • 103.130.147.211
                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSfile.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 94.245.104.56
                                                                                                                                                https://issuu.com/mathildagr/docs/pmd9746827?fr=sZTMyNjc4NzAyNzMGet hashmaliciousUnknownBrowse
                                                                                                                                                • 150.171.28.10
                                                                                                                                                Damar Training.pdfGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                                                • 13.107.246.71
                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 23.101.168.44
                                                                                                                                                https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EXbdq1Yt-JxPlSgSPVHn69cB5_tprGzujznxzQ6i7mvvHA?e=6rgxHk&xsdata=MDV8MDJ8c2hhbm5vbi5wZW5uaW5ndG9uQGRlbm9yYS5jb218ODc2ZTM4NWQ3ZGI5NGM3MTA1MGQwOGRjZmE1Y2RjMDR8ZGIwYjk4ZTFlMjVkNDgzNWI3YzAxODE3MzZlNGQ3YmJ8MHwwfDYzODY2MDUyNDY3ODM3OTYwOXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18NDAwMDB8fHw%3d&sdata=ZGptdWdxOStnMWRSMzJwUXhzSVJYYVZWZm02QjdSeFlkNlF0K1FJSjFiND0%3dGet hashmaliciousUnknownBrowse
                                                                                                                                                • 52.108.8.12
                                                                                                                                                https://woobox.com/sf4hxrGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 20.60.166.164
                                                                                                                                                https://hotmail.cdisaomiguel.com.brGet hashmaliciousUnknownBrowse
                                                                                                                                                • 13.107.246.44
                                                                                                                                                https://cbb8e45a.9a6a27135394413fbc39df5b.workers.devGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 40.99.150.34
                                                                                                                                                ae713827-e32c-f66b-fbdb-5405db450711.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 150.171.27.10
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                • 20.42.65.92
                                                                                                                                                WHOLESALECONNECTIONSNLWfaD7DZqu0.exeGet hashmaliciousAmadeyBrowse
                                                                                                                                                • 185.215.113.36
                                                                                                                                                iIDqizT3Wx.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 185.215.113.16
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                • 185.215.113.206
                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 185.215.113.206
                                                                                                                                                file.exeGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                • 185.215.113.64
                                                                                                                                                file.exeGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                • 185.215.113.64
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                • 185.215.113.206
                                                                                                                                                file.exeGet hashmaliciousStealcBrowse
                                                                                                                                                • 185.215.113.206
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                • 185.215.113.16
                                                                                                                                                file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 185.215.113.206

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                ⊘No context

                                                                                                                                                Dropped Files

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                C:\ProgramData\LgAmARwZ\Application.exefile.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RedLine, Stealc, VidarBrowse

                                                                                                                                                      Created / dropped Files

                                                                                                                                                      C:\ProgramData\LgAmARwZ\Application.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\DMv89K955Y.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):526848
                                                                                                                                                      Entropy (8bit):7.806472978332927
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:NL07gVkGXreL4LV8wdljMagCkqZBtzPmmhwAoXC+YF:Nw7g6GXrnFkm1PmmBqC+YF
                                                                                                                                                      MD5:26D8D52BAC8F4615861F39E118EFA28D
                                                                                                                                                      SHA1:EFD5A7CCD128FFE280AF75EC8B3E465C989D9E35
                                                                                                                                                      SHA-256:8521A1F4D523A2A9E7F8DDF01147E65E7F3FF54B268E9B40F91E07DC01FA148F
                                                                                                                                                      SHA-512:1911A21D654E317FBA50308007BB9D56FBA2C19A545EF6DFAADE17821B0F8FC48AA041C8A4A0339BEE61CBD429852D561985E27C574ECED716B2E937AFA18733
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 61%
                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E..........."...0.................. ... ....@.. .......................`............@.....................................O.... ..L....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...L.... ......................@..@.reloc.......@......................@..B........................H........(...............>..............................................6.(.....(....*z.,..{....,..{....o......(....*....0...........s....}.....s....}.....s....}.....s....}.....s....}.....s....}......{....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}......{....s....}.....s....}.....s ...}.....s!...}.....("....{.... .....Ws#...o$....{....r...po%....{.... ......s&...o'....{.....o(....{.... (... ....s#...o$....{....r...po%....{.... ......s&...o'....{..

                                                                                                                                                      C:\ProgramData\LgAmARwZ\Application.exe:Zone.Identifier

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\DMv89K955Y.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):26
                                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                      Malicious:true
                                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_c.exe_e4c3d21a16c9aeaf1266466c63d8d9705b3a67_824aa9a7_ef2193a6-090d-4a05-9af0-0eb0c6cdb92f\Report.wer

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):65536
                                                                                                                                                      Entropy (8bit):0.656076609178009
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:96:HrFGohlz5OksmhgvoI7Rn6tQXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlG:Lvlzgkm0BU/gjhzuiF3Z24IO8n
                                                                                                                                                      MD5:D18859FD35375726C5182B8489A5B165
                                                                                                                                                      SHA1:2A60BEA9255FA1D8A4AC9F34F15209A6528EE6B0
                                                                                                                                                      SHA-256:5F498CFF91E59A3279F21537D69DB7B575E5B8F575FEAE690C341160E81DDE69
                                                                                                                                                      SHA-512:1146B35466491CF5DB46543946EA18EBF482B23E63B38C89A278D8AD279980F8792C409A88C646A0E3BB4DE97DBD7877F143A4387E51F4875E0D4362F5240A4B
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.9.5.4.9.2.9.2.7.4.7.9.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.9.5.4.9.3.0.1.1.8.5.5.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.2.1.9.3.a.6.-.0.9.0.d.-.4.a.0.5.-.9.a.f.0.-.0.e.b.0.c.6.c.d.b.9.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.3.7.d.0.0.4.-.a.4.c.2.-.4.d.e.7.-.9.0.2.c.-.7.2.7.a.e.e.3.d.8.7.9.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.8.-.0.0.0.1.-.0.0.1.5.-.4.8.7.b.-.e.e.8.4.8.1.2.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.1.4.e.f.3.1.d.8.5.c.3.d.9.a.8.b.1.0.7.3.b.5.0.3.6.a.7.5.8.b.f.0.0.0.0.f.f.f.f.!.0.0.0.0.d.6.3.3.d.0.a.3.6.f.f.0.b.4.4.d.c.4.6.0.5.5.a.d.4.6.f.8.8.f.2.b.f.4.e.8.c.b.d.1.!.c...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.3.1.:.1.8.:.3.9.:.

                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER3737.tmp.dmp

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      File Type:Mini DuMP crash report, 14 streams, Fri Nov 1 17:15:29 2024, 0x1205a4 type
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):33106
                                                                                                                                                      Entropy (8bit):1.70572995359242
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:96:5dw8InwpqhpyZmCm8kRzHi772QQ8xwtHtfTL8sPFEyAUIGhxrKVkjS68LWx4WqxX:bz1E8kpHOqseTToW7ABGhzT3cTUZz0e4
                                                                                                                                                      MD5:6AE3A4AA9D0F1654335D9DE6E4866B51
                                                                                                                                                      SHA1:29F7C2263794AA968E5AA6A8609BBF61A940FED3
                                                                                                                                                      SHA-256:C5A1AD85E95A59D50416A493A287B7EEDA4561475DA894BBA15D5D1378BB0097
                                                                                                                                                      SHA-512:8C20C7CD46D0E3A517AE22D8C3094BE812D0099B1D3CE0168AA5F8733CCF571AC4BC7AE7179A563543FBA8EAAE3AE196300108829067968DF4F0FC4088EDF00C
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:MDMP..a..... .........%g........................d...........................T.......8...........T................v......................................................................................................eJ..............GenuineIntel............T.......x...y.%g-............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER37A6.tmp.WERInternalMetadata.xml

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):8358
                                                                                                                                                      Entropy (8bit):3.695617837985723
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:192:R6l7wVeJcP6t4x36Y/e6mgmfQB7prO89bu2sfXam:R6lXJM6c6Y26mgmfQXuVfb
                                                                                                                                                      MD5:6FB82134D3949D38A22F11CFD442232C
                                                                                                                                                      SHA1:FAECA1A6BD1D23FCCC4F125D8BF7F0FCDDF1CE05
                                                                                                                                                      SHA-256:88E2411C435FB076718ED9142C70BBA7BF1CF3246309663DEBCC68BF74987452
                                                                                                                                                      SHA-512:861AB0A1742DC206DB52A882F852178EDF376D4B673879901915A2C705546F38D0841780BD4C024DF1BA7C4782B2E8062E9E79778E183BA3535C406D57211DDB
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.3.2.<./.P.i.

                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER3833.tmp.xml

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):4675
                                                                                                                                                      Entropy (8bit):4.453714919536688
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:48:cvIwWl8zsXJg77aI9/ur1WpW8VYoYm8M4JQm7Fs+q8vxkdsnQQEd:uIjf5I75urE7VYJOK8snQQEd
                                                                                                                                                      MD5:3093A65B00138F1807D3012DE701D25F
                                                                                                                                                      SHA1:BE74F9854B3A4353F629F88B000E95D988B69431
                                                                                                                                                      SHA-256:89BEB684D60A4395B0A8A21492566DF88D87C85E5454DCCCDC2C0ED2BEA2180C
                                                                                                                                                      SHA-512:21D0D76F9FC7DF0AEDF3FED7000C11DFE6F3D10C280BD9D35C3FA5E49B5BCEBA43D826AB7862488A447F6EA571D9E6B818111B0BB1412CA36EAA4BC33DDF2732
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="569298" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                      C:\ProgramData\yIVKiWQb\Application.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):697344
                                                                                                                                                      Entropy (8bit):7.5113260957779415
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:1C9xh5OJOrc8LdwcIu2m+DgXOisuP96dHwxcvDuf4mJY317NgUF:1C9xc58Ldwm2m8gDsuwdHwqvDua31pB
                                                                                                                                                      MD5:39683F5EFD3B4C5C87C9105789937C4F
                                                                                                                                                      SHA1:6E13B68B6D7CEED584E2017533FF02F55E5D7BC0
                                                                                                                                                      SHA-256:338E0FF63C91C9CF9DBB586FA4BA6C6D4EE367183534B887232A33F54D069F48
                                                                                                                                                      SHA-512:71AF6A5053681D87F76F1DDE3B9617325B2B84B9DC53001188C84EC2BD4ABA500B3938249E4050DED0155B931E05B169EC207AF45D6AC7D8EF437FAEE767DE9E
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|............"...0...... ........... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................(....*:.(......}....*Z(.....(....s....(....*6.(.....(....*.0..........s....}.....{.....X..s....o.....{.... .....0s....o.....{....r...po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.....|.1s....o.....{....r5..po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.... .....%s....o.....{....rW..po.....(.....{....o.....s ...}.....{.....D.%s....o.....{.....`..s....o.....{....r...po...

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\449e940ceb.exe.log

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe
                                                                                                                                                      File Type:CSV text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):1281
                                                                                                                                                      Entropy (8bit):5.370111951859942
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                                                                                                                                                      MD5:12C61586CD59AA6F2A21DF30501F71BD
                                                                                                                                                      SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                                                                                                                                                      SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                                                                                                                                                      SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Application.exe.log

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\ProgramData\LgAmARwZ\Application.exe
                                                                                                                                                      File Type:CSV text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):1281
                                                                                                                                                      Entropy (8bit):5.370111951859942
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                                                                                                                                                      MD5:12C61586CD59AA6F2A21DF30501F71BD
                                                                                                                                                      SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                                                                                                                                                      SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                                                                                                                                                      SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DMv89K955Y.exe.log

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\DMv89K955Y.exe
                                                                                                                                                      File Type:CSV text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):1281
                                                                                                                                                      Entropy (8bit):5.370111951859942
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
                                                                                                                                                      MD5:12C61586CD59AA6F2A21DF30501F71BD
                                                                                                                                                      SHA1:E6B279DC134544867C868E3FF3C267A06CE340C7
                                                                                                                                                      SHA-256:EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
                                                                                                                                                      SHA-512:B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
                                                                                                                                                      Malicious:true
                                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):697344
                                                                                                                                                      Entropy (8bit):7.5113260957779415
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:1C9xh5OJOrc8LdwcIu2m+DgXOisuP96dHwxcvDuf4mJY317NgUF:1C9xc58Ldwm2m8gDsuwdHwqvDua31pB
                                                                                                                                                      MD5:39683F5EFD3B4C5C87C9105789937C4F
                                                                                                                                                      SHA1:6E13B68B6D7CEED584E2017533FF02F55E5D7BC0
                                                                                                                                                      SHA-256:338E0FF63C91C9CF9DBB586FA4BA6C6D4EE367183534B887232A33F54D069F48
                                                                                                                                                      SHA-512:71AF6A5053681D87F76F1DDE3B9617325B2B84B9DC53001188C84EC2BD4ABA500B3938249E4050DED0155B931E05B169EC207AF45D6AC7D8EF437FAEE767DE9E
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|............"...0...... ........... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................(....*:.(......}....*Z(.....(....s....(....*6.(.....(....*.0..........s....}.....{.....X..s....o.....{.... .....0s....o.....{....r...po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.....|.1s....o.....{....r5..po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.... .....%s....o.....{....rW..po.....(.....{....o.....s ...}.....{.....D.%s....o.....{.....`..s....o.....{....r...po...

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):705536
                                                                                                                                                      Entropy (8bit):7.683066770292285
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:IgluT689oXcRNE96FRBJubuNlZezPnbo1GMImGZsoUNpUk9/FlwJlTZ6:IglI6zX4HFBubu/mPbIO+LIo/L
                                                                                                                                                      MD5:4936C0448E4102EF927A39DBF8091A28
                                                                                                                                                      SHA1:D633D0A36FF0B44DC46055AD46F88F2BF4E8CBD1
                                                                                                                                                      SHA-256:89E63F0332E999A1A687C00809B8DC74BBEA5A3F4E073B9BF6E5D263E4841F25
                                                                                                                                                      SHA-512:02F068E64BDE6D398D9E4847ED25930B07B1DC01A2E18EFA4DF380BCF01824C32936C11CE58E3DE3E5C9A4D2CB42E1C888F33DD065877CB753F4125A0528DEBA
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....#g............................p.............@.......................................@..................................}..(.......................................................................................,............................text............................... ..`.rdata..t~..........................@..@.data...l"...........|..............@....00cfg..............................@..@.reloc..............................@..B.back...........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\5[1].exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):7694336
                                                                                                                                                      Entropy (8bit):5.8138974524908855
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:49152:YG4jTexTzZSkPCuFR7cLVWhIjPuQXMVjPnF//Rp6I8E8eoh6DoBAKibTOoCBjRhi:YGUgFSkXR7E4h2PX8V7F/nyEHlKD
                                                                                                                                                      MD5:FACECD9A8C5218A49469DF1C3756D5F9
                                                                                                                                                      SHA1:727A4F481EB340712F3B75CDBCD06664139EF812
                                                                                                                                                      SHA-256:BC417517A6B5949226151ED2DC3B398051FABE68C7C1B1AD92279E6425761962
                                                                                                                                                      SHA-512:C23B59A2B68D873C6681AB4E3488226D7E925D2A72841095FBA6EE0A24EAF010D3EA42AB94B5B94BB1ED5E02A0524301913694C7B5396FDDEE5636150DBCB02B
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 46%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.!g...............(..H..du..2............I...@...........................u.......u...@... ..............................pr.P(............................r.D ............................q......................wr.p............................text.....H.......H.................`..`.data.........I.......H.............@....rdata...n....]..p...x].............@..@.eh_framP/....r..0....q.............@..@.bss....`1...0r..........................idata..P(...pr..*....r.............@....CRT....0.....r......Br.............@....tls..........r......Dr.............@....reloc..D ....r.."...Fr.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\10000600101\c.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):705536
                                                                                                                                                      Entropy (8bit):7.683066770292285
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:IgluT689oXcRNE96FRBJubuNlZezPnbo1GMImGZsoUNpUk9/FlwJlTZ6:IglI6zX4HFBubu/mPbIO+LIo/L
                                                                                                                                                      MD5:4936C0448E4102EF927A39DBF8091A28
                                                                                                                                                      SHA1:D633D0A36FF0B44DC46055AD46F88F2BF4E8CBD1
                                                                                                                                                      SHA-256:89E63F0332E999A1A687C00809B8DC74BBEA5A3F4E073B9BF6E5D263E4841F25
                                                                                                                                                      SHA-512:02F068E64BDE6D398D9E4847ED25930B07B1DC01A2E18EFA4DF380BCF01824C32936C11CE58E3DE3E5C9A4D2CB42E1C888F33DD065877CB753F4125A0528DEBA
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....#g............................p.............@.......................................@..................................}..(.......................................................................................,............................text............................... ..`.rdata..t~..........................@..@.data...l"...........|..............@....00cfg..............................@..@.reloc..............................@..B.back...........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\10000610101\5.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):7694336
                                                                                                                                                      Entropy (8bit):5.8138974524908855
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:49152:YG4jTexTzZSkPCuFR7cLVWhIjPuQXMVjPnF//Rp6I8E8eoh6DoBAKibTOoCBjRhi:YGUgFSkXR7E4h2PX8V7F/nyEHlKD
                                                                                                                                                      MD5:FACECD9A8C5218A49469DF1C3756D5F9
                                                                                                                                                      SHA1:727A4F481EB340712F3B75CDBCD06664139EF812
                                                                                                                                                      SHA-256:BC417517A6B5949226151ED2DC3B398051FABE68C7C1B1AD92279E6425761962
                                                                                                                                                      SHA-512:C23B59A2B68D873C6681AB4E3488226D7E925D2A72841095FBA6EE0A24EAF010D3EA42AB94B5B94BB1ED5E02A0524301913694C7B5396FDDEE5636150DBCB02B
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 46%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.!g...............(..H..du..2............I...@...........................u.......u...@... ..............................pr.P(............................r.D ............................q......................wr.p............................text.....H.......H.................`..`.data.........I.......H.............@....rdata...n....]..p...x].............@..@.eh_framP/....r..0....q.............@..@.bss....`1...0r..........................idata..P(...pr..*....r.............@....CRT....0.....r......Br.............@....tls..........r......Dr.............@....reloc..D ....r.."...Fr.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):697344
                                                                                                                                                      Entropy (8bit):7.5113260957779415
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:1C9xh5OJOrc8LdwcIu2m+DgXOisuP96dHwxcvDuf4mJY317NgUF:1C9xc58Ldwm2m8gDsuwdHwqvDua31pB
                                                                                                                                                      MD5:39683F5EFD3B4C5C87C9105789937C4F
                                                                                                                                                      SHA1:6E13B68B6D7CEED584E2017533FF02F55E5D7BC0
                                                                                                                                                      SHA-256:338E0FF63C91C9CF9DBB586FA4BA6C6D4EE367183534B887232A33F54D069F48
                                                                                                                                                      SHA-512:71AF6A5053681D87F76F1DDE3B9617325B2B84B9DC53001188C84EC2BD4ABA500B3938249E4050DED0155B931E05B169EC207AF45D6AC7D8EF437FAEE767DE9E
                                                                                                                                                      Malicious:true
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|............"...0...... ........... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................(....*:.(......}....*Z(.....(....s....(....*6.(.....(....*.0..........s....}.....{.....X..s....o.....{.... .....0s....o.....{....r...po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.....|.1s....o.....{....r5..po.....(.....{....o.....s....}.....{.... .... ....s....o.....{.... .....%s....o.....{....rW..po.....(.....{....o.....s ...}.....{.....D.%s....o.....{.....`..s....o.....{....r...po...

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\246122658369

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):86196
                                                                                                                                                      Entropy (8bit):7.854099020949277
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:1536:CGcIgeM/V61m5QSshldFYWSh/xBOT4BvKD9ogxob/Pilk9nPntpVZQDDDVnI9M:XcIgjdshZYWSh/LvKDWP7Kmn7TQDDDV5
                                                                                                                                                      MD5:A61AE73FB376FCB246755AB06AAD575B
                                                                                                                                                      SHA1:870CE372A0337853845684CCD07B5E10CC7D64B7
                                                                                                                                                      SHA-256:1C081246374AE422F129CEF95A72E61EF18E63FDD16AE2A93480FED9A3141064
                                                                                                                                                      SHA-512:4A274307036B3E9239AAA32E343BE4E63E281EDB51BBD22D784ABC69872B7A59A80877DB0975C2A8AD5837E0866D67EDBEA514D5C313270AAF877A76BA911157
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3.*..m..,.X.c.#....O.*.i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(.........k.._:U.d..2.v..G..\^)a.........Q.......?.A.9..@...'...G. .....w.G.....;.n..3...W...:<r.]...yl......6A

                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\Desktop\DMv89K955Y.exe
                                                                                                                                                      File Type:MS Windows 95 Internet shortcut text (URL=<"C:\ProgramData\LgAmARwZ\Application.exe">), ASCII text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):64
                                                                                                                                                      Entropy (8bit):4.835479296672176
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:HRAbABGQFwGZkRE3ZizRMQJHn:HRYFxFAi/
                                                                                                                                                      MD5:76F433B3FBD6C3D0CA94F50293292ECC
                                                                                                                                                      SHA1:55CECBED8CB353B05CE046AD185488FBCB91BED8
                                                                                                                                                      SHA-256:B04B8AD6F41D55D715FEE227F2C1E4D333627FF2A1B89C0F55E35384028F1B32
                                                                                                                                                      SHA-512:829F24BD3474ABB436D4F685FC6EC8172B1D3AD548CFA71B3CD263B0A3FC353AE4CDD0AB925397FDB07BFA859E79711A6C0B7DBDD95B94B419FEDCE60090BDB6
                                                                                                                                                      Malicious:true
                                                                                                                                                      Preview:[InternetShortcut].URL="C:\ProgramData\LgAmARwZ\Application.exe"

                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yIVKiWQb.url

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe
                                                                                                                                                      File Type:MS Windows 95 Internet shortcut text (URL=<"C:\ProgramData\yIVKiWQb\Application.exe">), ASCII text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):64
                                                                                                                                                      Entropy (8bit):4.960479296672176
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:HRAbABGQFwGZkREnyGk2RMQJHn:HRYFxFeyzQ
                                                                                                                                                      MD5:72376109EECFEBD465824B9241BF0900
                                                                                                                                                      SHA1:70FC309A136AC9EDC283B3A2549ACFB5D8ECEF2A
                                                                                                                                                      SHA-256:34EF33AC529EE528F6D93AA11A322194C9DA17832B5C5EE3A0C7C7204E78082E
                                                                                                                                                      SHA-512:E57B8C207669DC485C42D627867DA0A13C0BF90535C85B946EFFFF06AECE5D69B79C6BC6A158A9ED391AF8D8E848E43D51242B2D2736FED902DD5895D0523B9C
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:[InternetShortcut].URL="C:\ProgramData\yIVKiWQb\Application.exe"

                                                                                                                                                      C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):1835008
                                                                                                                                                      Entropy (8bit):4.471071980319489
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6144:mzZfpi6ceLPx9skLmb0fnZWSP3aJG8nAgeiJRMMhA2zX4WABluuN9jDH5S:oZHtnZWOKnMM6bFp7j4
                                                                                                                                                      MD5:1589E4465AEC333921CD5A66B71F9434
                                                                                                                                                      SHA1:9075E4641227C6792D3E4F93F34BAFEFA7827725
                                                                                                                                                      SHA-256:33CFD831B2382946CD41387A4DE93D6047CC2586D686250BAFEF115427E7A3A3
                                                                                                                                                      SHA-512:7DB134ECD63B3B9A4592CFE44E70F89ABCA8188E26760EB04104E0C315924315BE90B680957E2DD0D242F222758FC6F4861E5614B7088D5D2FE6E5577CCC5766
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..o..,..............................................................................................................................................................................................................................................................................................................................................=Sy.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      Static File Info

                                                                                                                                                      General

                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                      Entropy (8bit):7.806472978332927
                                                                                                                                                      TrID:
                                                                                                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                      File name:DMv89K955Y.exe
                                                                                                                                                      File size:526'848 bytes
                                                                                                                                                      MD5:26d8d52bac8f4615861f39e118efa28d
                                                                                                                                                      SHA1:efd5a7ccd128ffe280af75ec8b3e465c989d9e35
                                                                                                                                                      SHA256:8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f
                                                                                                                                                      SHA512:1911a21d654e317fba50308007bb9d56fba2c19a545ef6dfaade17821b0f8fc48aa041c8a4a0339bee61cbd429852d561985e27c574eced716b2e937afa18733
                                                                                                                                                      SSDEEP:12288:NL07gVkGXreL4LV8wdljMagCkqZBtzPmmhwAoXC+YF:Nw7g6GXrnFkm1PmmBqC+YF
                                                                                                                                                      TLSH:3FB4F0646789FF37C80497B602E3474063F1C9CE9371926F5D287EA06EE62E4BF21586
                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E..........."...0.................. ... ....@.. .......................`............@................................

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:00928e8e8686b000

                                                                                                                                                      Static PE Info

                                                                                                                                                      General

                                                                                                                                                      Entrypoint:0x481d02
                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                      Digitally signed:false
                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                      Time Stamp:0x9C4597AB [Wed Jan 29 23:35:07 2053 UTC]
                                                                                                                                                      TLS Callbacks:
                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                      OS Version Major:4
                                                                                                                                                      OS Version Minor:0
                                                                                                                                                      File Version Major:4
                                                                                                                                                      File Version Minor:0
                                                                                                                                                      Subsystem Version Major:4
                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                      Entrypoint Preview

                                                                                                                                                      Instruction
                                                                                                                                                      jmp dword ptr [00402000h]
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al
                                                                                                                                                      add byte ptr [eax], al

                                                                                                                                                      Data Directories

                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x81cb00x4f.text
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x820000x64c.rsrc
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x840000xc.reloc
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x81c940x1c.text
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                      Sections

                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                      .text0x20000x7fd080x7fe0075f2ac8a96bb0d92f3f97cd9dd30eab5False0.9008087426686217data7.82060659626259IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                      .rsrc0x820000x64c0x8000debfa436281c704c9ee066454e0fad6False0.34423828125data3.609739725055676IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                      .reloc0x840000xc0x2005c1eb79a40bfe81cf7a03dd65edba60aFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                      Resources

                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                      RT_VERSION0x820900x3bcdata0.41527196652719667
                                                                                                                                                      RT_MANIFEST0x8245c0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                                                      Imports

                                                                                                                                                      DLLImport
                                                                                                                                                      mscoree.dll_CorExeMain

                                                                                                                                                      Network Behavior

                                                                                                                                                      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Target ID:0
                                                                                                                                                      Start time:13:14:03
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\Desktop\DMv89K955Y.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Users\user\Desktop\DMv89K955Y.exe"
                                                                                                                                                      Imagebase:0xe30000
                                                                                                                                                      File size:526'848 bytes
                                                                                                                                                      MD5 hash:26D8D52BAC8F4615861F39E118EFA28D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:4
                                                                                                                                                      Start time:13:14:21
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      Imagebase:0x170000
                                                                                                                                                      File size:65'440 bytes
                                                                                                                                                      MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:5
                                                                                                                                                      Start time:13:14:21
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      Imagebase:0xa60000
                                                                                                                                                      File size:65'440 bytes
                                                                                                                                                      MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:8
                                                                                                                                                      Start time:13:14:33
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\10000600101\c.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\10000600101\c.exe"
                                                                                                                                                      Imagebase:0x4e0000
                                                                                                                                                      File size:705'536 bytes
                                                                                                                                                      MD5 hash:4936C0448E4102EF927A39DBF8091A28
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:9
                                                                                                                                                      Start time:13:14:33
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:11
                                                                                                                                                      Start time:13:14:46
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\ProgramData\LgAmARwZ\Application.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\ProgramData\LgAmARwZ\Application.exe"
                                                                                                                                                      Imagebase:0x7ff7934f0000
                                                                                                                                                      File size:526'848 bytes
                                                                                                                                                      MD5 hash:26D8D52BAC8F4615861F39E118EFA28D
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                      • Detection: 61%, ReversingLabs
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:13
                                                                                                                                                      Start time:13:15:05
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      Imagebase:0x950000
                                                                                                                                                      File size:65'440 bytes
                                                                                                                                                      MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:14
                                                                                                                                                      Start time:13:15:28
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\10000600101\c.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\10000600101\c.exe"
                                                                                                                                                      Imagebase:0x4e0000
                                                                                                                                                      File size:705'536 bytes
                                                                                                                                                      MD5 hash:4936C0448E4102EF927A39DBF8091A28
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3028510262.0000000002857000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3079021722.000000000285F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.3079043172.0000000002865000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:17
                                                                                                                                                      Start time:13:15:29
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 272
                                                                                                                                                      Imagebase:0x880000
                                                                                                                                                      File size:483'680 bytes
                                                                                                                                                      MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:18
                                                                                                                                                      Start time:13:15:43
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\10000610101\5.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\10000610101\5.exe"
                                                                                                                                                      Imagebase:0xb20000
                                                                                                                                                      File size:7'694'336 bytes
                                                                                                                                                      MD5 hash:FACECD9A8C5218A49469DF1C3756D5F9
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000012.00000003.3440249875.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000012.00000003.3439410034.00000000009B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000012.00000003.3440479974.000000000DBED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000012.00000003.4130683296.0000000001359000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 46%, ReversingLabs
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:19
                                                                                                                                                      Start time:13:15:52
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\10000630101\449e940ceb.exe"
                                                                                                                                                      Imagebase:0x350000
                                                                                                                                                      File size:697'344 bytes
                                                                                                                                                      MD5 hash:39683F5EFD3B4C5C87C9105789937C4F
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 100%, Avira
                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:20
                                                                                                                                                      Start time:13:15:53
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                                                                      Imagebase:0xa10000
                                                                                                                                                      File size:42'064 bytes
                                                                                                                                                      MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:21
                                                                                                                                                      Start time:13:16:05
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\ProgramData\yIVKiWQb\Application.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\ProgramData\yIVKiWQb\Application.exe"
                                                                                                                                                      Imagebase:0x9b0000
                                                                                                                                                      File size:697'344 bytes
                                                                                                                                                      MD5 hash:39683F5EFD3B4C5C87C9105789937C4F
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Antivirus matches:
                                                                                                                                                      • Detection: 100%, Avira
                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                      Reputation:low
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:22
                                                                                                                                                      Start time:13:16:07
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                                                                                                                                                      Imagebase:0x7ff684c40000
                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:23
                                                                                                                                                      Start time:13:16:07
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                                                                      Imagebase:0xe20000
                                                                                                                                                      File size:42'064 bytes
                                                                                                                                                      MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:24
                                                                                                                                                      Start time:13:16:09
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,15013827744706186800,13121207676491278986,262144 /prefetch:8
                                                                                                                                                      Imagebase:0x7ff684c40000
                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:25
                                                                                                                                                      Start time:13:17:26
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\service123.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\service123.exe"
                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                      File size:314'617'856 bytes
                                                                                                                                                      MD5 hash:B66A61DD0EFDB3AD15CE2756930C2003
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:26
                                                                                                                                                      Start time:13:17:26
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                                                                                                                                      Imagebase:0xcf0000
                                                                                                                                                      File size:187'904 bytes
                                                                                                                                                      MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:27
                                                                                                                                                      Start time:13:17:26
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:29
                                                                                                                                                      Start time:13:17:27
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 536
                                                                                                                                                      Imagebase:0x880000
                                                                                                                                                      File size:483'680 bytes
                                                                                                                                                      MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:30
                                                                                                                                                      Start time:13:17:30
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\service123.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Temp\/service123.exe
                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                      File size:314'617'856 bytes
                                                                                                                                                      MD5 hash:B66A61DD0EFDB3AD15CE2756930C2003
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:31
                                                                                                                                                      Start time:13:18:02
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\service123.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Temp\/service123.exe
                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                      File size:314'617'856 bytes
                                                                                                                                                      MD5 hash:B66A61DD0EFDB3AD15CE2756930C2003
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:36
                                                                                                                                                      Start time:13:19:01
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\service123.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Temp\/service123.exe
                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                      File size:314'617'856 bytes
                                                                                                                                                      MD5 hash:B66A61DD0EFDB3AD15CE2756930C2003
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:37
                                                                                                                                                      Start time:13:20:02
                                                                                                                                                      Start date:01/11/2024
                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\service123.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Temp\/service123.exe
                                                                                                                                                      Imagebase:0x760000
                                                                                                                                                      File size:314'617'856 bytes
                                                                                                                                                      MD5 hash:B66A61DD0EFDB3AD15CE2756930C2003
                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:false

                                                                                                                                                      Disassembly

                                                                                                                                                      Reset < >

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:18.8%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                        Total number of Nodes:18
                                                                                                                                                        Total number of Limit Nodes:0

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00007FFD34694E38 Relevance: 5.5, Strings: 4, Instructions: 461COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 0 7ffd34694e38-7ffd34694e3a 1 7ffd34694e3c-7ffd34694e3f 0->1 2 7ffd34694e70-7ffd34694e76 0->2 1->2 4 7ffd34694e7d-7ffd34694e90 2->4 5 7ffd34694e78 call 7ffd34693020 2->5 7 7ffd34694e92-7ffd34694e96 4->7 5->4 8 7ffd34694e98-7ffd34694e9f 7->8 9 7ffd34694ea1-7ffd34694eb0 7->9 12 7ffd34694ed6-7ffd34694edc 8->12 10 7ffd34694edd-7ffd34694efa 9->10 11 7ffd34694eb2-7ffd34694ecf 9->11 15 7ffd34694efc-7ffd34694f2c 10->15 16 7ffd34694f30-7ffd34694f45 10->16 13 7ffd34694ed4 11->13 13->7 13->12 15->16 20 7ffd346958b9-7ffd346958da 16->20 21 7ffd34694f4b-7ffd34694f5e 16->21 26 7ffd346958dc-7ffd346958ea 20->26 27 7ffd34695910-7ffd34695912 20->27 21->20 32 7ffd346958ec-7ffd3469590e 26->32 33 7ffd34695934-7ffd34695967 26->33 29 7ffd3469598e-7ffd34695991 27->29 30 7ffd34695913 27->30 34 7ffd34695993-7ffd34695997 29->34 35 7ffd34695984 30->35 36 7ffd34695914-7ffd34695917 30->36 32->27 51 7ffd346959d8-7ffd346959e3 33->51 53 7ffd34695968-7ffd3469596b 33->53 43 7ffd3469599e-7ffd346959a5 34->43 38 7ffd34695985-7ffd34695986 35->38 36->34 37 7ffd34695919 36->37 40 7ffd3469591b 37->40 41 7ffd3469591d 37->41 38->29 40->41 41->29 44 7ffd3469591f-7ffd34695922 41->44 46 7ffd346959ab-7ffd346959b8 43->46 47 7ffd34697823-7ffd34697848 43->47 44->43 48 7ffd34695924 44->48 46->47 50 7ffd346959be-7ffd346959d6 46->50 63 7ffd3469784a 47->63 64 7ffd346977e2 47->64 52 7ffd34695926-7ffd34695930 48->52 48->53 50->47 50->51 56 7ffd346959e7 51->56 52->33 53->56 57 7ffd3469596d 53->57 56->47 62 7ffd346959ed-7ffd346959fa 56->62 60 7ffd3469596f 57->60 61 7ffd34695970-7ffd34695983 57->61 60->61 61->35 61->38 62->47 66 7ffd34695a00-7ffd34695a1b 62->66 67 7ffd3469784c-7ffd3469787a 63->67 68 7ffd34697880-7ffd34697888 63->68 64->47 69 7ffd346977e4-7ffd34697806 call 7ffd34690bc0 64->69 66->47 71 7ffd34695a21-7ffd34695a2c 66->71 67->68 81 7ffd3469788f-7ffd34697891 68->81 69->47 71->47 75 7ffd34695a32-7ffd34695a4a 71->75 75->47 80 7ffd34695a50-7ffd34695a8a call 7ffd34690bc0 75->80 80->47 96 7ffd34695a90-7ffd34695a9d 80->96 82 7ffd346978ef-7ffd346978fa 81->82 83 7ffd34697893-7ffd34697898 81->83 83->82 85 7ffd3469789a-7ffd346978ac call 7ffd346932e0 call 7ffd346932f0 83->85 92 7ffd346978b1-7ffd346978be 85->92 93 7ffd346978c0-7ffd346978c1 92->93 94 7ffd346978c4 92->94 93->94 97 7ffd346978c9-7ffd346978cd 94->97 96->47 98 7ffd34695aa3-7ffd34695abb 96->98 101 7ffd346978d4-7ffd346978dd 97->101 98->47 99 7ffd34695ac1-7ffd34695ad7 98->99 99->47 100 7ffd34695add-7ffd34695af3 99->100 100->47 102 7ffd34695af9-7ffd34695b04 100->102 103 7ffd346978df-7ffd346978e0 101->103 104 7ffd346978e3-7ffd346978ed 101->104 102->47 105 7ffd34695b0a-7ffd34695b25 102->105 103->104 104->81 105->47 106 7ffd34695b2b-7ffd34695b44 105->106 106->47 108 7ffd34695b4a-7ffd34695b55 106->108 108->47 109 7ffd34695b5b-7ffd34695b70 108->109 109->47 110 7ffd34695b76-7ffd34695b92 109->110 110->47 111 7ffd34695b98-7ffd34695ba3 110->111 111->47 112 7ffd34695ba9-7ffd34695bcb call 7ffd34690bc0 111->112 112->64
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 8/i4$F$F$`#s4
                                                                                                                                                        • API String ID: 0-2969305715
                                                                                                                                                        • Opcode ID: 79fc073a5533ac87bacf241e437cec8c7beb77c165e754605649873656826252
                                                                                                                                                        • Instruction ID: df7565c35b03df65d8da2a7070bbf3ebbc001e420c97cac104299f159f172b3c
                                                                                                                                                        • Opcode Fuzzy Hash: 79fc073a5533ac87bacf241e437cec8c7beb77c165e754605649873656826252
                                                                                                                                                        • Instruction Fuzzy Hash: 29F1F120E0D6968BE7A5DF64C4B52B5B7E1FF46302F1445BAC14DCB183DABCA885C781
                                                                                                                                                        Function 00007FFD3469AE31 Relevance: 3.9, Strings: 1, Instructions: 2674COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: oK_H
                                                                                                                                                        • API String ID: 0-2078986833
                                                                                                                                                        • Opcode ID: 3299c9040074ab79844f4701f221e251f9f7b5e5cef7463270133a3c2066a102
                                                                                                                                                        • Instruction ID: 3e5f7e300d66f6a7aad033068dca386d9cb1420f4a908cad97d5e16dca00f71c
                                                                                                                                                        • Opcode Fuzzy Hash: 3299c9040074ab79844f4701f221e251f9f7b5e5cef7463270133a3c2066a102
                                                                                                                                                        • Instruction Fuzzy Hash: FE23C530A185568AE7A4DF18C0E4AB9F3E1FF46344F64967DC18ACB196DB78ACC1C781
                                                                                                                                                        Function 00007FFD34698A32 Relevance: 3.1, Strings: 1, Instructions: 1887COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: `
                                                                                                                                                        • API String ID: 0-2679148245
                                                                                                                                                        • Opcode ID: c56df8fac3f5d8e604f846e2a485a8be5789f17fc716694167a71226d576c796
                                                                                                                                                        • Instruction ID: de2e78907cefa8871e753b7a48b153fc0492ff1804872360c51010b3976a1bc3
                                                                                                                                                        • Opcode Fuzzy Hash: c56df8fac3f5d8e604f846e2a485a8be5789f17fc716694167a71226d576c796
                                                                                                                                                        • Instruction Fuzzy Hash: 48D2D931B2C95A8BEB68DE5884A56F973D2FF65314F28427DC14ED32C6DD29BC428B40
                                                                                                                                                        Function 00007FFD346972EC Relevance: 1.7, Strings: 1, Instructions: 456COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 983 7ffd346972ec-7ffd3469731b 987 7ffd34697321-7ffd3469732e 983->987 988 7ffd34697823-7ffd34697848 983->988 987->988 989 7ffd34697334-7ffd34697341 987->989 995 7ffd3469784a 988->995 996 7ffd346977e2 988->996 989->988 990 7ffd34697347-7ffd34697354 989->990 990->988 992 7ffd3469735a-7ffd34697375 990->992 992->988 994 7ffd3469737b-7ffd34697386 992->994 994->988 997 7ffd3469738c-7ffd346973a4 994->997 998 7ffd3469784c-7ffd3469787a 995->998 999 7ffd34697880-7ffd34697888 995->999 996->988 1000 7ffd346977e4-7ffd34697806 call 7ffd34690bc0 996->1000 997->988 1001 7ffd346973aa-7ffd346973c3 997->1001 998->999 1010 7ffd3469788f-7ffd34697891 999->1010 1000->988 1001->988 1005 7ffd346973c9-7ffd3469740e call 7ffd34690bc0 1001->1005 1005->988 1022 7ffd34697414-7ffd3469741f 1005->1022 1011 7ffd346978ef-7ffd346978fa 1010->1011 1012 7ffd34697893-7ffd34697898 1010->1012 1012->1011 1014 7ffd3469789a-7ffd346978ac call 7ffd346932e0 call 7ffd346932f0 1012->1014 1021 7ffd346978b1-7ffd346978be 1014->1021 1023 7ffd346978c0-7ffd346978c1 1021->1023 1024 7ffd346978c4 1021->1024 1022->988 1025 7ffd34697425-7ffd3469743d 1022->1025 1023->1024 1027 7ffd346978c9-7ffd346978cd 1024->1027 1025->988 1026 7ffd34697443-7ffd34697459 1025->1026 1026->988 1028 7ffd3469745f-7ffd34697478 1026->1028 1030 7ffd346978d4-7ffd346978dd 1027->1030 1028->988 1029 7ffd3469747e-7ffd34697489 1028->1029 1029->988 1031 7ffd3469748f-7ffd346974a7 1029->1031 1032 7ffd346978df-7ffd346978e0 1030->1032 1033 7ffd346978e3-7ffd346978ed 1030->1033 1031->988 1034 7ffd346974ad-7ffd346974b8 1031->1034 1032->1033 1033->1010 1034->988 1035 7ffd346974be-7ffd346974d9 1034->1035 1035->988 1037 7ffd346974df-7ffd346974f5 1035->1037 1037->988 1038 7ffd346974fb-7ffd34697511 1037->1038 1038->988 1039 7ffd34697517-7ffd34697530 1038->1039 1039->988 1040 7ffd34697536-7ffd3469754c 1039->1040 1040->988 1041 7ffd34697552-7ffd3469756b 1040->1041 1041->988 1042 7ffd34697571-7ffd346975d5 call 7ffd34690bc0 1041->1042 1042->988 1050 7ffd346975db-7ffd346975e6 1042->1050 1050->988 1051 7ffd346975ec-7ffd34697604 1050->1051 1051->988 1052 7ffd3469760a-7ffd34697615 1051->1052 1052->988 1053 7ffd3469761b-7ffd34697628 1052->1053 1053->988 1054 7ffd3469762e-7ffd34697649 1053->1054 1054->988 1055 7ffd3469764f-7ffd34697665 1054->1055 1055->988 1056 7ffd3469766b-7ffd34697684 1055->1056 1056->988 1057 7ffd3469768a-7ffd346976c4 call 7ffd34690bc0 1056->1057 1057->988 1063 7ffd346976ca-7ffd346976e2 1057->1063 1063->988 1064 7ffd346976e8-7ffd346976f3 1063->1064 1064->988 1065 7ffd346976f9-7ffd34697706 1064->1065 1065->988 1066 7ffd3469770c-7ffd34697719 1065->1066 1066->988 1067 7ffd3469771f-7ffd3469772c 1066->1067 1067->988 1068 7ffd34697732-7ffd3469774a 1067->1068 1068->988 1069 7ffd34697750-7ffd3469775b 1068->1069 1069->988 1070 7ffd34697761-7ffd34697779 1069->1070 1070->988 1071 7ffd3469777f-7ffd34697798 1070->1071 1071->988 1072 7ffd3469779e-7ffd346977b7 1071->1072 1072->988 1073 7ffd346977b9-7ffd346977c4 1072->1073 1073->988 1074 7ffd346977c6-7ffd346977d3 1073->1074 1074->988 1075 7ffd346977d5-7ffd346977de 1074->1075 1075->996
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: `#s4
                                                                                                                                                        • API String ID: 0-97455654
                                                                                                                                                        • Opcode ID: 7a6e737513fa96bf744ff4b3d115430e42fc0e5bff615a55ce0869cd0f134f4f
                                                                                                                                                        • Instruction ID: eedd314628365947808fef0ba5e1c21802b80b4bfbda0508c23c2c99cc1cebca
                                                                                                                                                        • Opcode Fuzzy Hash: 7a6e737513fa96bf744ff4b3d115430e42fc0e5bff615a55ce0869cd0f134f4f
                                                                                                                                                        • Instruction Fuzzy Hash: EB02B430E18556CAD3A4DF58C0B4671F6F2FF09346F1096BAC189CA582DAB898C5D7C1
                                                                                                                                                        Function 00007FFD3469618F Relevance: 1.6, Strings: 1, Instructions: 307COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1160 7ffd3469618f-7ffd346961d0 1165 7ffd346961d6-7ffd346961e1 1160->1165 1166 7ffd34697823-7ffd34697848 1160->1166 1165->1166 1167 7ffd346961e7-7ffd346961f4 1165->1167 1172 7ffd3469784a 1166->1172 1173 7ffd346977e2 1166->1173 1167->1166 1169 7ffd346961fa-7ffd34696207 1167->1169 1169->1166 1171 7ffd3469620d-7ffd3469621a 1169->1171 1171->1166 1174 7ffd34696220-7ffd34696238 1171->1174 1175 7ffd3469784c-7ffd3469787a 1172->1175 1176 7ffd34697880-7ffd34697888 1172->1176 1173->1166 1178 7ffd346977e4-7ffd34697806 call 7ffd34690bc0 1173->1178 1174->1166 1177 7ffd3469623e-7ffd34696249 1174->1177 1175->1176 1188 7ffd3469788f-7ffd34697891 1176->1188 1177->1166 1180 7ffd3469624f-7ffd3469625c 1177->1180 1178->1166 1180->1166 1184 7ffd34696262-7ffd346962a9 call 7ffd34690bc0 1180->1184 1184->1166 1200 7ffd346962af-7ffd346962ba 1184->1200 1189 7ffd346978ef-7ffd346978fa 1188->1189 1190 7ffd34697893-7ffd34697898 1188->1190 1190->1189 1193 7ffd3469789a-7ffd346978ac call 7ffd346932e0 call 7ffd346932f0 1190->1193 1199 7ffd346978b1-7ffd346978be 1193->1199 1201 7ffd346978c0-7ffd346978c1 1199->1201 1202 7ffd346978c4 1199->1202 1200->1166 1203 7ffd346962c0-7ffd346962d8 1200->1203 1201->1202 1205 7ffd346978c9-7ffd346978cd 1202->1205 1203->1166 1204 7ffd346962de-7ffd346962f4 1203->1204 1204->1166 1206 7ffd346962fa-7ffd34696310 1204->1206 1208 7ffd346978d4-7ffd346978dd 1205->1208 1206->1166 1207 7ffd34696316-7ffd34696321 1206->1207 1207->1166 1209 7ffd34696327-7ffd3469633f 1207->1209 1210 7ffd346978df-7ffd346978e0 1208->1210 1211 7ffd346978e3-7ffd346978ed 1208->1211 1209->1166 1212 7ffd34696345-7ffd34696350 1209->1212 1210->1211 1211->1188 1212->1166 1213 7ffd34696356-7ffd34696363 1212->1213 1213->1166 1215 7ffd34696369-7ffd34696376 1213->1215 1215->1166 1216 7ffd3469637c-7ffd34696389 1215->1216 1216->1166 1217 7ffd3469638f-7ffd346963a7 1216->1217 1217->1166 1218 7ffd346963ad-7ffd346963b8 1217->1218 1218->1166 1219 7ffd346963be-7ffd346963cb 1218->1219 1219->1166 1220 7ffd346963d1-7ffd346963ec 1219->1220 1220->1166 1221 7ffd346963f2-7ffd34696408 1220->1221 1221->1166 1222 7ffd3469640e-7ffd34696424 1221->1222 1222->1166 1223 7ffd3469642a-7ffd34696443 1222->1223 1223->1166 1224 7ffd34696449-7ffd34696454 1223->1224 1224->1166 1225 7ffd3469645a-7ffd34696467 1224->1225 1225->1166 1226 7ffd3469646d-7ffd34696488 1225->1226 1226->1166 1227 7ffd3469648e-7ffd346964ae call 7ffd34690bc0 1226->1227 1227->1166
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: P s4
                                                                                                                                                        • API String ID: 0-4154607838
                                                                                                                                                        • Opcode ID: 0127c05e982f766b5b188e30f0e544f72afe7d03d028b4d532e48a664b1b0779
                                                                                                                                                        • Instruction ID: c5f1e0cf1d0334ca614b40996fafdd774945b4fd7f3d375991945f9c012851f3
                                                                                                                                                        • Opcode Fuzzy Hash: 0127c05e982f766b5b188e30f0e544f72afe7d03d028b4d532e48a664b1b0779
                                                                                                                                                        • Instruction Fuzzy Hash: 20C1C130E18656CAE3A4DF18C0A4675F7F2FF09346B6496B9C18DCB192DAB898C5C7C1
                                                                                                                                                        Function 00007FFD34696774 Relevance: 1.5, Strings: 1, Instructions: 267COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1231 7ffd34696774-7ffd346967aa 1236 7ffd346967b0-7ffd346967cb 1231->1236 1237 7ffd34697823-7ffd34697848 1231->1237 1236->1237 1238 7ffd346967d1-7ffd346967dc 1236->1238 1244 7ffd3469784a 1237->1244 1245 7ffd346977e2 1237->1245 1238->1237 1239 7ffd346967e2-7ffd346967fd 1238->1239 1239->1237 1241 7ffd34696803-7ffd3469680e 1239->1241 1241->1237 1243 7ffd34696814-7ffd34696821 1241->1243 1243->1237 1246 7ffd34696827-7ffd3469683f 1243->1246 1247 7ffd3469784c-7ffd3469787a 1244->1247 1248 7ffd34697880-7ffd34697888 1244->1248 1245->1237 1249 7ffd346977e4-7ffd34697806 call 7ffd34690bc0 1245->1249 1246->1237 1250 7ffd34696845-7ffd3469685b 1246->1250 1247->1248 1259 7ffd3469788f-7ffd34697891 1248->1259 1249->1237 1250->1237 1254 7ffd34696861-7ffd346968a6 call 7ffd34690bc0 1250->1254 1254->1237 1273 7ffd346968ac-7ffd346968b7 1254->1273 1260 7ffd346978ef-7ffd346978fa 1259->1260 1261 7ffd34697893-7ffd34697898 1259->1261 1261->1260 1263 7ffd3469789a-7ffd346978ac call 7ffd346932e0 call 7ffd346932f0 1261->1263 1269 7ffd346978b1-7ffd346978be 1263->1269 1271 7ffd346978c0-7ffd346978c1 1269->1271 1272 7ffd346978c4 1269->1272 1271->1272 1276 7ffd346978c9-7ffd346978cd 1272->1276 1273->1237 1274 7ffd346968bd-7ffd346968ca 1273->1274 1274->1237 1275 7ffd346968d0-7ffd346968dd 1274->1275 1275->1237 1277 7ffd346968e3-7ffd346968fb 1275->1277 1279 7ffd346978d4-7ffd346978dd 1276->1279 1277->1237 1278 7ffd34696901-7ffd3469690c 1277->1278 1278->1237 1280 7ffd34696912-7ffd3469692d 1278->1280 1281 7ffd346978df-7ffd346978e0 1279->1281 1282 7ffd346978e3-7ffd346978ed 1279->1282 1280->1237 1283 7ffd34696933-7ffd3469694c 1280->1283 1281->1282 1282->1259 1283->1237 1284 7ffd34696952-7ffd3469695d 1283->1284 1284->1237 1286 7ffd34696963-7ffd34696978 1284->1286 1286->1237 1287 7ffd3469697e-7ffd3469698c 1286->1287 1287->1237 1288 7ffd34696992-7ffd3469699f 1287->1288 1288->1237 1289 7ffd346969a5-7ffd346969c0 1288->1289 1289->1237 1290 7ffd346969c6-7ffd346969dc 1289->1290 1290->1237 1291 7ffd346969e2-7ffd34696a01 call 7ffd34690bc0 1290->1291 1291->1237
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 0!s4
                                                                                                                                                        • API String ID: 0-3443971562
                                                                                                                                                        • Opcode ID: f41e3d437366b33e631360b08eb6e7062c1fbf5d6a875d1375dc05eb185d58e1
                                                                                                                                                        • Instruction ID: 355a2a338c94a865beb2718bee0c98f0c88ec50bfd8c41043e6f26ccfea46e60
                                                                                                                                                        • Opcode Fuzzy Hash: f41e3d437366b33e631360b08eb6e7062c1fbf5d6a875d1375dc05eb185d58e1
                                                                                                                                                        • Instruction Fuzzy Hash: 89A1B030E186568AE3A4DF58C0B4771F7E2FF09346F1096BAC18DCA192DAB89885C7C1
                                                                                                                                                        Function 00007FFD3469A69D Relevance: .4, Instructions: 379COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1761 7ffd3469a69d-7ffd3469a6ba 1763 7ffd3469a6bc-7ffd3469a6e5 call 7ffd346933a0 1761->1763 1764 7ffd3469a6f0-7ffd3469a72b 1761->1764 1770 7ffd3469a6ea-7ffd3469a6ef call 7ffd346933b0 1763->1770 1773 7ffd3469ab65-7ffd3469ab9b 1764->1773 1774 7ffd3469a731-7ffd3469a747 1764->1774 1770->1764 1774->1773 1775 7ffd3469a74d-7ffd3469a758 1774->1775 1775->1773 1776 7ffd3469a75e-7ffd3469a76b 1775->1776 1776->1773 1778 7ffd3469a771-7ffd3469a789 1776->1778 1778->1773 1779 7ffd3469a78f-7ffd3469a7a5 1778->1779 1779->1773 1780 7ffd3469a7ab-7ffd3469a7c4 1779->1780 1780->1773 1781 7ffd3469a7ca-7ffd3469a7e3 1780->1781 1781->1773 1782 7ffd3469a7e9-7ffd3469a7ff 1781->1782 1782->1773 1783 7ffd3469a805-7ffd3469a810 1782->1783 1783->1773 1784 7ffd3469a816-7ffd3469a831 1783->1784 1784->1773 1785 7ffd3469a837-7ffd3469a84d 1784->1785 1785->1773 1786 7ffd3469a853-7ffd3469a869 1785->1786 1786->1773 1787 7ffd3469a86f-7ffd3469a888 1786->1787 1787->1773 1788 7ffd3469a88e-7ffd3469a899 1787->1788 1788->1773 1789 7ffd3469a89f-7ffd3469a8f1 call 7ffd34690bc0 1788->1789 1789->1773 1796 7ffd3469a8f7-7ffd3469a90d 1789->1796 1796->1773 1797 7ffd3469a913-7ffd3469a91e 1796->1797 1797->1773 1798 7ffd3469a924-7ffd3469a931 1797->1798 1798->1773 1799 7ffd3469a937-7ffd3469a944 1798->1799 1799->1773 1800 7ffd3469a94a-7ffd3469a957 1799->1800 1800->1773 1801 7ffd3469a95d-7ffd3469a978 1800->1801 1801->1773 1802 7ffd3469a97e-7ffd3469a989 1801->1802 1802->1773 1803 7ffd3469a98f-7ffd3469a99c 1802->1803 1803->1773 1804 7ffd3469a9a2-7ffd3469a9af 1803->1804 1804->1773 1805 7ffd3469a9b5-7ffd3469a9c2 1804->1805 1805->1773 1806 7ffd3469a9c8-7ffd3469a9d5 1805->1806 1806->1773 1807 7ffd3469a9db-7ffd3469a9f3 1806->1807 1807->1773 1808 7ffd3469a9f9-7ffd3469aa12 1807->1808 1808->1773 1809 7ffd3469aa18-7ffd3469aa2b 1808->1809 1809->1773 1810 7ffd3469aa31-7ffd3469aa42 1809->1810 1810->1773 1811 7ffd3469aa48-7ffd3469aa55 1810->1811 1811->1773 1812 7ffd3469aa5b-7ffd3469aa76 1811->1812 1812->1773 1813 7ffd3469aa7c-7ffd3469aa92 1812->1813 1813->1773 1814 7ffd3469aa98-7ffd3469aaae 1813->1814 1814->1773 1815 7ffd3469aab4-7ffd3469aabf 1814->1815 1815->1773 1816 7ffd3469aac5-7ffd3469aae0 1815->1816 1816->1773 1817 7ffd3469aae6-7ffd3469aaf1 1816->1817 1817->1773 1818 7ffd3469aaf3-7ffd3469ab0e 1817->1818 1818->1773 1819 7ffd3469ab10-7ffd3469ab26 1818->1819 1819->1773 1820 7ffd3469ab28-7ffd3469ab45 call 7ffd34690bc0 1819->1820 1824 7ffd3469ab4c-7ffd3469ab64 1820->1824
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: a42ad6e1e577472e4851e0e7e160d1eb27b55bba8228f90c9031fee874112130
                                                                                                                                                        • Instruction ID: cab6cd395d3fadef9951da47158904854fdafe5753b0d0e549dee268b03334aa
                                                                                                                                                        • Opcode Fuzzy Hash: a42ad6e1e577472e4851e0e7e160d1eb27b55bba8228f90c9031fee874112130
                                                                                                                                                        • Instruction Fuzzy Hash: F2E1B430A081928EE3A4DF14C4E8571F7E1FF0A315F1497AAC199CB296DB7998D0DB85
                                                                                                                                                        Function 00007FFD34695BCE Relevance: .3, Instructions: 306COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: abbed89b1a49fe3de234b97015ff264d9a9212c93ad619389d6b9c70abf52b99
                                                                                                                                                        • Instruction ID: f0164e2baa8e410f50a528eb5a8a4444d9f57b6069eaee30ca706468c11861b3
                                                                                                                                                        • Opcode Fuzzy Hash: abbed89b1a49fe3de234b97015ff264d9a9212c93ad619389d6b9c70abf52b99
                                                                                                                                                        • Instruction Fuzzy Hash: DCC1B230E18656CAE3A4DF58C0B4671F7E2FF09346B5496B9C18DCB192DAB89885C7C1
                                                                                                                                                        Function 00007FFD34696FD0 Relevance: .3, Instructions: 295COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 727d69454d2b629af27ba95212447d8f4565550012ef05c29931470fe2168ce0
                                                                                                                                                        • Instruction ID: 8dfd8c2d1dffc1680102cd612fae8c39915d8722a3db676f77cd68e24a417738
                                                                                                                                                        • Opcode Fuzzy Hash: 727d69454d2b629af27ba95212447d8f4565550012ef05c29931470fe2168ce0
                                                                                                                                                        • Instruction Fuzzy Hash: 49B19130E086568BE3A4DF68C0F0375F6E2FF49346F1456BAC189CB192DAB99881D7C1
                                                                                                                                                        Function 00007FFD34699EB9 Relevance: .3, Instructions: 293COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 379f8608e4b8e3a69374a28e7894bc7e916d7bd9d8c2625d72014c7e1f95876d
                                                                                                                                                        • Instruction ID: 9c9f50bad9be341e95e918552d9a5c31c8a0109f64a42d8f6113fc9db1816f8a
                                                                                                                                                        • Opcode Fuzzy Hash: 379f8608e4b8e3a69374a28e7894bc7e916d7bd9d8c2625d72014c7e1f95876d
                                                                                                                                                        • Instruction Fuzzy Hash: 41B1A330A086D28AEB95DF14C8A8665F7F0FF06305F148ABAC199CB1D3D77D9884C785
                                                                                                                                                        Function 00007FFD34696A05 Relevance: .3, Instructions: 289COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: faf4006fd1a247b358390c586b4a4abbdc0b3a45a4d3545b0b892809580aa0e6
                                                                                                                                                        • Instruction ID: b86b16674f35070a1711325dc8e559c19a03c1c36c0d7654b5762cadd926b865
                                                                                                                                                        • Opcode Fuzzy Hash: faf4006fd1a247b358390c586b4a4abbdc0b3a45a4d3545b0b892809580aa0e6
                                                                                                                                                        • Instruction Fuzzy Hash: 1FB1B130E186568BE3A4DF18C0A4675F7F2FF09346F1496BAC18DCB192DAB89885D7C1
                                                                                                                                                        Function 00007FFD34696CEE Relevance: .3, Instructions: 287COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 11fbe8b7a6b8059c3c8948e37529ada8a202e005848d030b1f7138df0a9db5f3
                                                                                                                                                        • Instruction ID: a71093e93a42136752aad8ea3832615bc20d6ad68d4642a30ace5108a317b51d
                                                                                                                                                        • Opcode Fuzzy Hash: 11fbe8b7a6b8059c3c8948e37529ada8a202e005848d030b1f7138df0a9db5f3
                                                                                                                                                        • Instruction Fuzzy Hash: 32B1B430E186568AE3A4DF58C0B4771F7E1FF09346F14967AC18DCB192DAB89885D7C1
                                                                                                                                                        Function 00007FFD346964B1 Relevance: .3, Instructions: 280COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 23a42abbc5ac7bdcfd0e1c16c03780d3ad3f81ce1da22861d741e9b542cb7b70
                                                                                                                                                        • Instruction ID: 4f13ae0b2f8d26a35abafc78c853ae48769e9aa3ecc25b7b1678da64b173e305
                                                                                                                                                        • Opcode Fuzzy Hash: 23a42abbc5ac7bdcfd0e1c16c03780d3ad3f81ce1da22861d741e9b542cb7b70
                                                                                                                                                        • Instruction Fuzzy Hash: 7EB1C230E186568BE3A4DF58C0A4771F6E2FF09346F1496BAC18DCB192DAB89885C7C1
                                                                                                                                                        Function 00007FFD34695EF6 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 0a145d0fbf3ff944cffcbde362000aeb7eaaee4ac5329054fd1007a710e8f71d
                                                                                                                                                        • Instruction ID: ed7519293a4bb2146295a7ce3e492d23f4db72a891dc91052b7f57e11c298577
                                                                                                                                                        • Opcode Fuzzy Hash: 0a145d0fbf3ff944cffcbde362000aeb7eaaee4ac5329054fd1007a710e8f71d
                                                                                                                                                        • Instruction Fuzzy Hash: 0CA1B230E186568BE3A4DF58C0A4675F7E2FF09346F5496B9C18DCA182DBB8A8C5C7C1
                                                                                                                                                        Function 00007FFD34697F64 Relevance: 1.6, APIs: 1, Instructions: 150injectionCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1076 7ffd34697f64-7ffd34697f6b 1077 7ffd34697f76-7ffd34697f8a 1076->1077 1078 7ffd34697f6d-7ffd34697f75 1076->1078 1079 7ffd34697f8c-7ffd34697fbf 1077->1079 1080 7ffd34697fc0-7ffd34698005 1077->1080 1078->1077 1079->1080 1084 7ffd34698007-7ffd3469800c 1080->1084 1085 7ffd3469800f-7ffd34698064 WriteProcessMemory 1080->1085 1084->1085 1087 7ffd34698066 1085->1087 1088 7ffd3469806c-7ffd3469809d 1085->1088 1087->1088
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MemoryProcessWrite
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3559483778-0
                                                                                                                                                        • Opcode ID: 18da4eedee4d831dffb747556227cd1127556f6eb0a196959decb20a396d54a1
                                                                                                                                                        • Instruction ID: 4fc1938261509a5a11c70deae2893693fc5d95b7356e9acc764a8a09b51bb5ea
                                                                                                                                                        • Opcode Fuzzy Hash: 18da4eedee4d831dffb747556227cd1127556f6eb0a196959decb20a396d54a1
                                                                                                                                                        • Instruction Fuzzy Hash: AB41E832D0CB5C8FDB299F9898566F97BE0EB95311F00426FE449D3282DE78A845C792
                                                                                                                                                        Function 00007FFD346980A1 Relevance: 1.6, APIs: 1, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1090 7ffd346980a1-7ffd346980ad 1091 7ffd346980b8-7ffd346980ca 1090->1091 1092 7ffd346980af-7ffd346980b7 1090->1092 1093 7ffd346980cc-7ffd346980ff 1091->1093 1094 7ffd34698100-7ffd34698102 1091->1094 1092->1091 1093->1094 1096 7ffd34698103-7ffd34698107 1094->1096 1097 7ffd34698109-7ffd3469811a 1096->1097 1098 7ffd34698141 1096->1098 1101 7ffd3469811c-7ffd34698140 1097->1101 1102 7ffd34698164-7ffd34698199 ReadProcessMemory 1097->1102 1098->1096 1099 7ffd34698143-7ffd34698163 1098->1099 1099->1102 1101->1098 1104 7ffd3469819b 1102->1104 1105 7ffd346981a1-7ffd346981d2 1102->1105 1104->1105
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MemoryProcessRead
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1726664587-0
                                                                                                                                                        • Opcode ID: 39c013feb0422a24ce61068748aa7f0b5a233ede20c12c0ed64225a9c3f20f73
                                                                                                                                                        • Instruction ID: 0b65cbb6ad9bdbdf7b6513a8216e24bbf7973e17972bfcd63340fc73a97fb560
                                                                                                                                                        • Opcode Fuzzy Hash: 39c013feb0422a24ce61068748aa7f0b5a233ede20c12c0ed64225a9c3f20f73
                                                                                                                                                        • Instruction Fuzzy Hash: 78415B31A0C7598FEB299F68D8566FD7BE0EF56320F40427EE089D3182CE786805C796
                                                                                                                                                        Function 00007FFD34697E60 Relevance: 1.6, APIs: 1, Instructions: 132memoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1108 7ffd34697e60-7ffd34697e67 1109 7ffd34697e69-7ffd34697e71 1108->1109 1110 7ffd34697e72-7ffd34697e7a 1108->1110 1109->1110 1111 7ffd34697e7c-7ffd34697ead 1110->1111 1112 7ffd34697eb0-7ffd34697f31 VirtualAllocEx 1110->1112 1111->1112 1116 7ffd34697f39-7ffd34697f5f 1112->1116 1117 7ffd34697f33 1112->1117 1117->1116
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: f4056fafb5d9a21bfd9af5d4f7a661c719c40941b31c284e37eab5be67164ea2
                                                                                                                                                        • Instruction ID: 073958d88e60405b8a75589a49be1a55c553a11b140fd59bb619ec54267473cc
                                                                                                                                                        • Opcode Fuzzy Hash: f4056fafb5d9a21bfd9af5d4f7a661c719c40941b31c284e37eab5be67164ea2
                                                                                                                                                        • Instruction Fuzzy Hash: 67312C31A1CB4D4FDB1DAB9898166F97BE0EB55321F00023ED049D3252DA74781687D5
                                                                                                                                                        Function 00007FFD346985BA Relevance: 1.6, APIs: 1, Instructions: 130processCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1119 7ffd346985ba-7ffd3469866d CreateProcessA 1122 7ffd34698675-7ffd34698706 call 7ffd34698722 1119->1122 1123 7ffd3469866f 1119->1123 1132 7ffd34698708 1122->1132 1133 7ffd3469870d-7ffd34698721 1122->1133 1123->1122 1132->1133
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateProcess
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 963392458-0
                                                                                                                                                        • Opcode ID: aa8cc129a85c107d799161f931c23f9bc8e09cb4122cf13c0ef0472e5a597d5c
                                                                                                                                                        • Instruction ID: 00e77549a8fcd338a020072fcb0741e2a31e7b01ceea33bd9fad68c50861a115
                                                                                                                                                        • Opcode Fuzzy Hash: aa8cc129a85c107d799161f931c23f9bc8e09cb4122cf13c0ef0472e5a597d5c
                                                                                                                                                        • Instruction Fuzzy Hash: 9441833160878C8FDB65EF48D8957E977A0FF59310F00422AE88DDB242CA34A945CB91
                                                                                                                                                        Function 00007FFD34697D58 Relevance: 1.6, APIs: 1, Instructions: 126threadCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1134 7ffd34697d58-7ffd34697d5f 1135 7ffd34697d6a-7ffd34697ddd 1134->1135 1136 7ffd34697d61-7ffd34697d69 1134->1136 1140 7ffd34697de7-7ffd34697e22 Wow64SetThreadContext 1135->1140 1141 7ffd34697ddf-7ffd34697de4 1135->1141 1136->1135 1143 7ffd34697e2a-7ffd34697e59 1140->1143 1144 7ffd34697e24 1140->1144 1141->1140 1144->1143
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ContextThreadWow64
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 983334009-0
                                                                                                                                                        • Opcode ID: 5efb04129136496e21885315a928c1a878801c68c17cccce063fdf207e008212
                                                                                                                                                        • Instruction ID: 72a2cab118fed95ac4b1ba90c7ab1b402d2cb957db3f7668062f6bd89bf2600c
                                                                                                                                                        • Opcode Fuzzy Hash: 5efb04129136496e21885315a928c1a878801c68c17cccce063fdf207e008212
                                                                                                                                                        • Instruction Fuzzy Hash: 8731E831D0CB584FDB299FA8985A6FABBE1EF56321F04422FD049D3192DB7468068791
                                                                                                                                                        Function 00007FFD34697C5D Relevance: 1.6, APIs: 1, Instructions: 120threadCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1146 7ffd34697c5d-7ffd34697c69 1147 7ffd34697c6b-7ffd34697c73 1146->1147 1148 7ffd34697c74-7ffd34697c83 1146->1148 1147->1148 1149 7ffd34697c85-7ffd34697c8d 1148->1149 1150 7ffd34697c8e-7ffd34697c9a 1148->1150 1149->1150 1151 7ffd34697c9c-7ffd34697ccf 1150->1151 1152 7ffd34697cd0-7ffd34697d24 ResumeThread 1150->1152 1151->1152 1157 7ffd34697d26 1152->1157 1158 7ffd34697d2c-7ffd34697d51 1152->1158 1157->1158
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ResumeThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 947044025-0
                                                                                                                                                        • Opcode ID: 8f78b7d397dfc861b325952e3796aa50a48bf69c885966bedf6d523c91c7f1ef
                                                                                                                                                        • Instruction ID: 21294aabc934d2ab96e10bf539a73ecab356041b8cdbfe97550e9c7aa29acd58
                                                                                                                                                        • Opcode Fuzzy Hash: 8f78b7d397dfc861b325952e3796aa50a48bf69c885966bedf6d523c91c7f1ef
                                                                                                                                                        • Instruction Fuzzy Hash: 3831F631A0C7888FDB5ADFA888566E97FE0EF57321F0842AFD089D7193DA786406C751

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 00007FFD34692E1D Relevance: .2, Instructions: 187COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000000.00000002.2568565100.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd34690000_DMv89K955Y.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 0d12ecfe1b5a74e3b612bd3a271041dc359fe64f0c3e06b7f127cb8bdfcbb170
                                                                                                                                                        • Instruction ID: 527921177dbe24996cad11503f05934f9e577f4033c88c1c97f576a2efc0bb7a
                                                                                                                                                        • Opcode Fuzzy Hash: 0d12ecfe1b5a74e3b612bd3a271041dc359fe64f0c3e06b7f127cb8bdfcbb170
                                                                                                                                                        • Instruction Fuzzy Hash: FE51142270C6554FD725AFACE8A56FA7BE0EF96325F0541B6D0CCCB187CA286845C782

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:5.3%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                        Signature Coverage:1.9%
                                                                                                                                                        Total number of Nodes:1783
                                                                                                                                                        Total number of Limit Nodes:28
                                                                                                                                                        execution_graph 15454 51a350 15459 51b135 15454->15459 15460 51b145 15459->15460 15461 51a35a 15459->15461 15460->15461 15466 51b3da InitializeCriticalSectionEx 15460->15466 15463 51b189 15461->15463 15467 51b19e 15463->15467 15466->15460 15468 51b1b4 15467->15468 15469 51b1ad 15467->15469 15476 51f508 15468->15476 15473 51f579 15469->15473 15472 51a364 15474 51f508 32 API calls 15473->15474 15475 51f58b 15474->15475 15475->15472 15479 51f76b 15476->15479 15480 51f777 ___scrt_is_nonwritable_in_current_image 15479->15480 15487 51fe41 EnterCriticalSection 15480->15487 15482 51f785 15488 51f58f 15482->15488 15484 51f792 15498 51f7ba 15484->15498 15487->15482 15489 51f5aa 15488->15489 15497 51f61d _unexpected 15488->15497 15490 51f5fd 15489->15490 15491 526d42 32 API calls 15489->15491 15489->15497 15492 526d42 32 API calls 15490->15492 15490->15497 15493 51f5f3 15491->15493 15494 51f613 15492->15494 15495 5239bb __freea 14 API calls 15493->15495 15496 5239bb __freea 14 API calls 15494->15496 15495->15490 15496->15497 15497->15484 15501 51fe58 LeaveCriticalSection 15498->15501 15500 51f539 15500->15472 15501->15500 16512 51cdf0 16513 523d97 ___scrt_uninitialize_crt 68 API calls 16512->16513 16514 51cdf8 16513->16514 16522 52427b 16514->16522 16516 51cdfd 16532 524326 16516->16532 16519 51ce27 16520 5239bb __freea 14 API calls 16519->16520 16521 51ce32 16520->16521 16523 524287 ___scrt_is_nonwritable_in_current_image 16522->16523 16536 51fe41 EnterCriticalSection 16523->16536 16525 5242fe 16541 52431d 16525->16541 16528 5242d2 DeleteCriticalSection 16530 5239bb __freea 14 API calls 16528->16530 16531 524292 16530->16531 16531->16525 16531->16528 16537 520188 16531->16537 16533 51ce0c DeleteCriticalSection 16532->16533 16534 52433d 16532->16534 16533->16516 16533->16519 16534->16533 16535 5239bb __freea 14 API calls 16534->16535 16535->16533 16536->16531 16538 52019b __fread_nolock 16537->16538 16544 520246 16538->16544 16540 5201a7 __fread_nolock 16540->16531 16594 51fe58 LeaveCriticalSection 16541->16594 16543 52430a 16543->16516 16545 520252 ___scrt_is_nonwritable_in_current_image 16544->16545 16546 52027f 16545->16546 16547 52025c 16545->16547 16554 520277 16546->16554 16555 51ccef EnterCriticalSection 16546->16555 16548 51fce2 __fread_nolock 29 API calls 16547->16548 16548->16554 16550 52029d 16556 5201b8 16550->16556 16552 5202aa 16570 5202d5 16552->16570 16554->16540 16555->16550 16557 5201c5 16556->16557 16558 5201e8 16556->16558 16559 51fce2 __fread_nolock 29 API calls 16557->16559 16560 5201e0 16558->16560 16561 523e05 ___scrt_uninitialize_crt 64 API calls 16558->16561 16559->16560 16560->16552 16562 520200 16561->16562 16563 524326 14 API calls 16562->16563 16564 520208 16563->16564 16565 525538 __fread_nolock 29 API calls 16564->16565 16566 520214 16565->16566 16573 527826 16566->16573 16569 5239bb __freea 14 API calls 16569->16560 16593 51cd03 LeaveCriticalSection 16570->16593 16572 5202db 16572->16554 16574 52784f 16573->16574 16579 52021b 16573->16579 16575 52789e 16574->16575 16577 527876 16574->16577 16576 51fce2 __fread_nolock 29 API calls 16575->16576 16576->16579 16580 5278c9 16577->16580 16579->16560 16579->16569 16581 5278d5 ___scrt_is_nonwritable_in_current_image 16580->16581 16588 5276fa EnterCriticalSection 16581->16588 16583 5278e3 16584 527914 16583->16584 16585 527786 __wsopen_s 32 API calls 16583->16585 16589 52794e 16584->16589 16585->16584 16588->16583 16592 52771d LeaveCriticalSection 16589->16592 16591 527937 16591->16579 16592->16591 16593->16572 16594->16543 16600 51f0e0 16603 51f107 16600->16603 16604 51f113 ___scrt_is_nonwritable_in_current_image 16603->16604 16611 51fe41 EnterCriticalSection 16604->16611 16606 51f11d 16607 51f14b 16606->16607 16609 525d97 __strnicoll 14 API calls 16606->16609 16612 51f169 16607->16612 16609->16606 16611->16606 16615 51fe58 LeaveCriticalSection 16612->16615 16614 51f105 16615->16614 15826 522f60 15827 522f6c ___scrt_is_nonwritable_in_current_image 15826->15827 15838 51fe41 EnterCriticalSection 15827->15838 15829 522f73 15839 52765c 15829->15839 15836 5230a2 2 API calls 15837 522f91 15836->15837 15858 522fb7 15837->15858 15838->15829 15840 527668 ___scrt_is_nonwritable_in_current_image 15839->15840 15841 527692 15840->15841 15842 527671 15840->15842 15861 51fe41 EnterCriticalSection 15841->15861 15843 52416e __dosmaperr 14 API calls 15842->15843 15845 527676 15843->15845 15846 51fb39 __fread_nolock 29 API calls 15845->15846 15848 522f82 15846->15848 15847 5276ca 15862 5276f1 15847->15862 15848->15837 15852 522fec GetStartupInfoW 15848->15852 15849 52769e 15849->15847 15851 5275ac __wsopen_s 15 API calls 15849->15851 15851->15849 15853 523009 15852->15853 15855 522f8c 15852->15855 15854 52765c 30 API calls 15853->15854 15853->15855 15856 523031 15854->15856 15855->15836 15856->15855 15857 523061 GetFileType 15856->15857 15857->15856 15866 51fe58 LeaveCriticalSection 15858->15866 15860 522fa2 15861->15849 15865 51fe58 LeaveCriticalSection 15862->15865 15864 5276f8 15864->15848 15865->15864 15866->15860 13735 51b8e2 13736 51b8ee ___scrt_is_nonwritable_in_current_image 13735->13736 13761 51b2ae 13736->13761 13738 51b8f5 13739 51ba4e 13738->13739 13749 51b91f ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 13738->13749 13810 51b644 IsProcessorFeaturePresent 13739->13810 13741 51ba55 13814 51ecaf 13741->13814 13746 51b93e 13747 51b9bf 13772 51f826 13747->13772 13749->13746 13749->13747 13793 51ecf9 13749->13793 13751 51b9c5 13776 4f8050 13751->13776 13753 51b9dc 13799 51b5e9 GetModuleHandleW 13753->13799 13756 51b9ea 13757 51b9f3 13756->13757 13801 51ecdb 13756->13801 13804 51b2e7 13757->13804 13762 51b2b7 13761->13762 13820 51b3fd IsProcessorFeaturePresent 13762->13820 13766 51b2c8 13767 51b2cc 13766->13767 13830 51cc50 13766->13830 13767->13738 13770 51b2e3 13770->13738 13773 51f82f 13772->13773 13775 51f834 13772->13775 13902 51f94f 13773->13902 13775->13751 14594 4fb600 13776->14594 13780 520707 67 API calls 13785 4f8106 ___std_exception_copy 13780->13785 13781 4f81cc 14616 4f5170 13781->14616 13783 4fa5bc 13783->13753 13784 520a2a 36 API calls 13784->13785 13785->13780 13785->13781 13785->13783 13785->13784 13786 520188 69 API calls 13785->13786 13791 5202dd 92 API calls 13785->13791 13792 5204f6 45 API calls __fread_nolock 13785->13792 14603 4f7d70 GetPEB 13785->14603 13786->13785 13789 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 13790 4fa60f 13789->13790 13790->13753 13791->13785 13792->13785 13794 51ed0f ___scrt_is_nonwritable_in_current_image _unexpected 13793->13794 13794->13747 13795 52297a _unexpected 39 API calls 13794->13795 13798 5211bc 13795->13798 13796 520139 CallUnexpected 39 API calls 13797 5211e6 13796->13797 13798->13796 13800 51b5f5 13799->13800 13800->13741 13800->13756 15230 51edfa 13801->15230 13805 51b2f3 13804->13805 13809 51b309 13805->13809 15301 51cc62 13805->15301 13807 51b301 13808 51c2ba ___scrt_uninitialize_crt 7 API calls 13807->13808 13808->13809 13809->13746 13811 51b65a __fread_nolock CallUnexpected 13810->13811 13812 51b705 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 13811->13812 13813 51b750 CallUnexpected 13812->13813 13813->13741 13815 51edfa CallUnexpected 21 API calls 13814->13815 13816 51ba5b 13815->13816 13817 51ecc5 13816->13817 13818 51edfa CallUnexpected 21 API calls 13817->13818 13819 51ba63 13818->13819 13821 51b2c3 13820->13821 13822 51c29b 13821->13822 13839 522116 13822->13839 13825 51c2a4 13825->13766 13827 51c2ac 13828 51c2b7 13827->13828 13853 522152 13827->13853 13828->13766 13893 5239f5 13830->13893 13833 51c2ba 13834 51c2c3 13833->13834 13835 51c2cd 13833->13835 13836 52121a ___vcrt_uninitialize_ptd 6 API calls 13834->13836 13835->13767 13837 51c2c8 13836->13837 13838 522152 ___vcrt_uninitialize_locks DeleteCriticalSection 13837->13838 13838->13835 13840 52211f 13839->13840 13842 522148 13840->13842 13843 51c2a0 13840->13843 13857 52903a 13840->13857 13844 522152 ___vcrt_uninitialize_locks DeleteCriticalSection 13842->13844 13843->13825 13845 5211e7 13843->13845 13844->13843 13874 528f4b 13845->13874 13850 521217 13850->13827 13852 5211fc 13852->13827 13854 52217c 13853->13854 13855 52215d 13853->13855 13854->13825 13856 522167 DeleteCriticalSection 13855->13856 13856->13854 13856->13856 13862 5290cc 13857->13862 13860 529072 InitializeCriticalSectionAndSpinCount 13861 52905d 13860->13861 13861->13840 13863 529054 13862->13863 13866 5290ed 13862->13866 13863->13860 13863->13861 13864 529155 GetProcAddress 13864->13863 13866->13863 13866->13864 13867 529146 13866->13867 13869 529081 LoadLibraryExW 13866->13869 13867->13864 13868 52914e FreeLibrary 13867->13868 13868->13864 13870 5290c8 13869->13870 13871 529098 GetLastError 13869->13871 13870->13866 13871->13870 13872 5290a3 ___vcrt_FlsSetValue 13871->13872 13872->13870 13873 5290b9 LoadLibraryExW 13872->13873 13873->13866 13875 5290cc ___vcrt_FlsSetValue 5 API calls 13874->13875 13876 528f65 13875->13876 13877 528f7e TlsAlloc 13876->13877 13878 5211f1 13876->13878 13878->13852 13879 528ffc 13878->13879 13880 5290cc ___vcrt_FlsSetValue 5 API calls 13879->13880 13881 529016 13880->13881 13882 529031 TlsSetValue 13881->13882 13883 52120a 13881->13883 13882->13883 13883->13850 13884 52121a 13883->13884 13885 52122a 13884->13885 13886 521224 13884->13886 13885->13852 13888 528f86 13886->13888 13889 5290cc ___vcrt_FlsSetValue 5 API calls 13888->13889 13890 528fa0 13889->13890 13891 528fb8 TlsFree 13890->13891 13892 528fac 13890->13892 13891->13892 13892->13885 13894 51b2d5 13893->13894 13895 523a05 13893->13895 13894->13770 13894->13833 13895->13894 13897 5230a2 13895->13897 13899 5230a9 13897->13899 13898 5230ec GetStdHandle 13898->13899 13899->13898 13900 52314e 13899->13900 13901 5230ff GetFileType 13899->13901 13900->13895 13901->13899 13903 51f958 13902->13903 13906 51f96e 13902->13906 13903->13906 13908 51f890 13903->13908 13905 51f965 13905->13906 13925 51fa5d 13905->13925 13906->13775 13909 51f899 13908->13909 13910 51f89c 13908->13910 13909->13905 13934 523170 13910->13934 13915 51f8b9 13961 51f97b 13915->13961 13916 51f8ad 13917 5239bb __freea 14 API calls 13916->13917 13919 51f8b3 13917->13919 13919->13905 13921 5239bb __freea 14 API calls 13922 51f8dd 13921->13922 13923 5239bb __freea 14 API calls 13922->13923 13924 51f8e3 13923->13924 13924->13905 13926 51face 13925->13926 13933 51fa6c 13925->13933 13926->13906 13927 52421e _unexpected 14 API calls 13927->13933 13928 51fad2 13929 5239bb __freea 14 API calls 13928->13929 13929->13926 13930 526daf WideCharToMultiByte __wsopen_s 13930->13933 13932 5239bb __freea 14 API calls 13932->13933 13933->13926 13933->13927 13933->13928 13933->13930 13933->13932 14313 526f82 13933->14313 13935 51f8a2 13934->13935 13936 523179 13934->13936 13940 526eab GetEnvironmentStringsW 13935->13940 13983 522a35 13936->13983 13941 526ec3 13940->13941 13946 51f8a7 13940->13946 13942 526daf __wsopen_s WideCharToMultiByte 13941->13942 13943 526ee0 13942->13943 13944 526ef5 13943->13944 13945 526eea FreeEnvironmentStringsW 13943->13945 13947 524366 __strnicoll 15 API calls 13944->13947 13945->13946 13946->13915 13946->13916 13948 526efc 13947->13948 13949 526f04 13948->13949 13950 526f15 13948->13950 13951 5239bb __freea 14 API calls 13949->13951 13952 526daf __wsopen_s WideCharToMultiByte 13950->13952 13953 526f09 FreeEnvironmentStringsW 13951->13953 13954 526f25 13952->13954 13953->13946 13955 526f34 13954->13955 13956 526f2c 13954->13956 13958 5239bb __freea 14 API calls 13955->13958 13957 5239bb __freea 14 API calls 13956->13957 13959 526f32 FreeEnvironmentStringsW 13957->13959 13958->13959 13959->13946 13964 51f990 13961->13964 13962 52421e _unexpected 14 API calls 13963 51f9b7 13962->13963 13965 51f9bf 13963->13965 13974 51f9c9 13963->13974 13964->13962 13966 5239bb __freea 14 API calls 13965->13966 13982 51f8c0 13966->13982 13967 51fa26 13968 5239bb __freea 14 API calls 13967->13968 13968->13982 13969 52421e _unexpected 14 API calls 13969->13974 13970 51fa35 14307 51f920 13970->14307 13974->13967 13974->13969 13974->13970 13976 51fa50 13974->13976 13978 5239bb __freea 14 API calls 13974->13978 14298 5220bc 13974->14298 13975 5239bb __freea 14 API calls 13977 51fa42 13975->13977 13979 51fb66 std::_Throw_Cpp_error 11 API calls 13976->13979 13980 5239bb __freea 14 API calls 13977->13980 13978->13974 13981 51fa5c 13979->13981 13980->13982 13982->13921 13984 522a40 13983->13984 13985 522a46 13983->13985 13987 5225a0 _unexpected 6 API calls 13984->13987 13986 5225df _unexpected 6 API calls 13985->13986 14006 522a4c 13985->14006 13988 522a60 13986->13988 13987->13985 13989 52421e _unexpected 14 API calls 13988->13989 13988->14006 13992 522a70 13989->13992 13991 522a51 14008 5235b3 13991->14008 13994 522a78 13992->13994 13995 522a8d 13992->13995 13996 5225df _unexpected 6 API calls 13994->13996 13997 5225df _unexpected 6 API calls 13995->13997 13998 522a84 13996->13998 13999 522a99 13997->13999 14004 5239bb __freea 14 API calls 13998->14004 14000 522aac 13999->14000 14001 522a9d 13999->14001 14003 522c8c _unexpected 14 API calls 14000->14003 14002 5225df _unexpected 6 API calls 14001->14002 14002->13998 14005 522ab7 14003->14005 14004->14006 14007 5239bb __freea 14 API calls 14005->14007 14006->13991 14030 520139 14006->14030 14007->13991 14009 5235dd 14008->14009 14119 52343f 14009->14119 14014 52360f 14016 5239bb __freea 14 API calls 14014->14016 14015 52361d 14133 52323a 14015->14133 14019 5235f6 14016->14019 14019->13935 14020 523655 14021 52416e __dosmaperr 14 API calls 14020->14021 14022 52365a 14021->14022 14024 5239bb __freea 14 API calls 14022->14024 14023 52369c 14029 5236e5 14023->14029 14144 52396e 14023->14144 14024->14019 14025 523670 14025->14023 14028 5239bb __freea 14 API calls 14025->14028 14027 5239bb __freea 14 API calls 14027->14019 14028->14023 14029->14027 14041 523aac 14030->14041 14033 520149 14034 520153 IsProcessorFeaturePresent 14033->14034 14035 520172 14033->14035 14037 52015f 14034->14037 14038 51ecc5 CallUnexpected 21 API calls 14035->14038 14039 51fb9a CallUnexpected 8 API calls 14037->14039 14040 52017c 14038->14040 14039->14035 14071 523d2f 14041->14071 14044 523ad3 14047 523adf ___scrt_is_nonwritable_in_current_image 14044->14047 14045 522acb __dosmaperr 14 API calls 14054 523b10 CallUnexpected 14045->14054 14046 523b2f 14050 52416e __dosmaperr 14 API calls 14046->14050 14047->14045 14047->14046 14048 523b41 CallUnexpected 14047->14048 14047->14054 14051 523b77 CallUnexpected 14048->14051 14085 51fe41 EnterCriticalSection 14048->14085 14049 523b19 14049->14033 14052 523b34 14050->14052 14057 523cb1 14051->14057 14058 523bb4 14051->14058 14069 523be2 14051->14069 14082 51fb39 14052->14082 14054->14046 14054->14048 14054->14049 14059 523cbc 14057->14059 14117 51fe58 LeaveCriticalSection 14057->14117 14058->14069 14086 52297a GetLastError 14058->14086 14062 51ecc5 CallUnexpected 21 API calls 14059->14062 14065 523cc4 14062->14065 14063 523c37 14063->14049 14070 52297a _unexpected 39 API calls 14063->14070 14066 52297a _unexpected 39 API calls 14066->14063 14068 52297a _unexpected 39 API calls 14068->14069 14113 523c5d 14069->14113 14070->14049 14072 523d3b ___scrt_is_nonwritable_in_current_image 14071->14072 14077 51fe41 EnterCriticalSection 14072->14077 14074 523d49 14078 523d8b 14074->14078 14077->14074 14081 51fe58 LeaveCriticalSection 14078->14081 14080 52013e 14080->14033 14080->14044 14081->14080 14083 51fd88 __fread_nolock 29 API calls 14082->14083 14084 51fb45 14083->14084 14084->14049 14085->14051 14087 522990 14086->14087 14088 522996 14086->14088 14089 5225a0 _unexpected 6 API calls 14087->14089 14090 5225df _unexpected 6 API calls 14088->14090 14110 52299a SetLastError 14088->14110 14089->14088 14091 5229b2 14090->14091 14093 52421e _unexpected 14 API calls 14091->14093 14091->14110 14094 5229c7 14093->14094 14098 5229e0 14094->14098 14099 5229cf 14094->14099 14095 522a2a 14095->14068 14096 522a2f 14097 520139 CallUnexpected 37 API calls 14096->14097 14100 522a34 14097->14100 14102 5225df _unexpected 6 API calls 14098->14102 14101 5225df _unexpected 6 API calls 14099->14101 14104 5229dd 14101->14104 14103 5229ec 14102->14103 14105 5229f0 14103->14105 14106 522a07 14103->14106 14108 5239bb __freea 14 API calls 14104->14108 14107 5225df _unexpected 6 API calls 14105->14107 14109 522c8c _unexpected 14 API calls 14106->14109 14107->14104 14108->14110 14111 522a12 14109->14111 14110->14095 14110->14096 14112 5239bb __freea 14 API calls 14111->14112 14112->14110 14114 523c61 14113->14114 14115 523c29 14113->14115 14118 51fe58 LeaveCriticalSection 14114->14118 14115->14049 14115->14063 14115->14066 14117->14059 14118->14115 14152 5231b8 14119->14152 14122 523472 14124 523489 14122->14124 14125 523477 GetACP 14122->14125 14123 523460 GetOEMCP 14123->14124 14124->14019 14126 524366 14124->14126 14125->14124 14127 5243a4 14126->14127 14131 524374 _unexpected 14126->14131 14128 52416e __dosmaperr 14 API calls 14127->14128 14130 523607 14128->14130 14129 52438f RtlAllocateHeap 14129->14130 14129->14131 14130->14014 14130->14015 14131->14127 14131->14129 14132 51efe1 _unexpected 2 API calls 14131->14132 14132->14131 14134 52343f 41 API calls 14133->14134 14136 52325a 14134->14136 14135 52335f 14137 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14135->14137 14136->14135 14138 523297 IsValidCodePage 14136->14138 14141 5232b2 __fread_nolock 14136->14141 14139 52343d 14137->14139 14138->14135 14140 5232a9 14138->14140 14139->14020 14139->14025 14140->14141 14142 5232d2 GetCPInfo 14140->14142 14192 5237c9 14141->14192 14142->14135 14142->14141 14145 52397a ___scrt_is_nonwritable_in_current_image 14144->14145 14272 51fe41 EnterCriticalSection 14145->14272 14147 523984 14273 523708 14147->14273 14153 5231d6 14152->14153 14159 5231cf 14152->14159 14154 52297a _unexpected 39 API calls 14153->14154 14153->14159 14155 5231f7 14154->14155 14160 524686 14155->14160 14159->14122 14159->14123 14161 52320d 14160->14161 14162 524699 14160->14162 14164 5246b3 14161->14164 14162->14161 14168 525d16 14162->14168 14165 5246c6 14164->14165 14166 5246db 14164->14166 14165->14166 14189 523152 14165->14189 14166->14159 14169 525d22 ___scrt_is_nonwritable_in_current_image 14168->14169 14170 52297a _unexpected 39 API calls 14169->14170 14171 525d2b 14170->14171 14173 525d71 14171->14173 14181 51fe41 EnterCriticalSection 14171->14181 14173->14161 14174 525d49 14182 525d97 14174->14182 14179 520139 CallUnexpected 39 API calls 14180 525d96 14179->14180 14181->14174 14183 525d5a 14182->14183 14184 525da5 _unexpected 14182->14184 14186 525d76 14183->14186 14184->14183 14185 525b4b _unexpected 14 API calls 14184->14185 14185->14183 14187 51fe58 CallUnexpected LeaveCriticalSection 14186->14187 14188 525d6d 14187->14188 14188->14173 14188->14179 14190 52297a _unexpected 39 API calls 14189->14190 14191 523157 14190->14191 14191->14166 14193 5237f1 GetCPInfo 14192->14193 14202 5238ba 14192->14202 14199 523809 14193->14199 14193->14202 14195 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14197 52396c 14195->14197 14197->14135 14203 52588a 14199->14203 14201 5292f4 44 API calls 14201->14202 14202->14195 14204 5231b8 __strnicoll 39 API calls 14203->14204 14205 5258aa 14204->14205 14223 52598b 14205->14223 14207 525966 14209 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14207->14209 14208 52595e 14226 52586a 14208->14226 14212 523871 14209->14212 14210 5258d7 14210->14207 14210->14208 14211 524366 __strnicoll 15 API calls 14210->14211 14214 5258fc __fread_nolock __strnicoll 14210->14214 14211->14214 14218 5292f4 14212->14218 14214->14208 14215 52598b __strnicoll MultiByteToWideChar 14214->14215 14216 525945 14215->14216 14216->14208 14217 52594c GetStringTypeW 14216->14217 14217->14208 14219 5231b8 __strnicoll 39 API calls 14218->14219 14220 529307 14219->14220 14232 52933d 14220->14232 14230 5259b5 14223->14230 14227 525876 14226->14227 14229 525887 14226->14229 14228 5239bb __freea 14 API calls 14227->14228 14227->14229 14228->14229 14229->14207 14231 5259a7 MultiByteToWideChar 14230->14231 14231->14210 14233 529358 __strnicoll 14232->14233 14234 52598b __strnicoll MultiByteToWideChar 14233->14234 14238 52939c 14234->14238 14235 529517 14236 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14235->14236 14237 523892 14236->14237 14237->14201 14238->14235 14239 524366 __strnicoll 15 API calls 14238->14239 14241 5293c2 __strnicoll 14238->14241 14252 52946a 14238->14252 14239->14241 14240 52586a __freea 14 API calls 14240->14235 14242 52598b __strnicoll MultiByteToWideChar 14241->14242 14241->14252 14243 52940b 14242->14243 14243->14252 14260 52266c 14243->14260 14246 529441 14251 52266c 7 API calls 14246->14251 14246->14252 14247 529479 14248 529502 14247->14248 14249 524366 __strnicoll 15 API calls 14247->14249 14253 52948b __strnicoll 14247->14253 14250 52586a __freea 14 API calls 14248->14250 14249->14253 14250->14252 14251->14252 14252->14240 14253->14248 14254 52266c 7 API calls 14253->14254 14255 5294ce 14254->14255 14255->14248 14269 526daf 14255->14269 14257 5294e8 14257->14248 14258 5294f1 14257->14258 14259 52586a __freea 14 API calls 14258->14259 14259->14252 14261 5228be LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary GetProcAddress 14260->14261 14262 522677 14261->14262 14263 5226a4 14262->14263 14264 52267d LCMapStringEx 14262->14264 14265 5226c9 __strnicoll 5 API calls 14263->14265 14268 5226c4 14264->14268 14267 5226bd LCMapStringW 14265->14267 14267->14268 14268->14246 14268->14247 14268->14252 14271 526dc2 __wsopen_s 14269->14271 14270 526e00 WideCharToMultiByte 14270->14257 14271->14270 14272->14147 14283 5203d8 14273->14283 14275 52372a 14276 5203d8 __fread_nolock 29 API calls 14275->14276 14277 523749 14276->14277 14278 523770 14277->14278 14279 5239bb __freea 14 API calls 14277->14279 14280 5239af 14278->14280 14279->14278 14297 51fe58 LeaveCriticalSection 14280->14297 14282 52399d 14282->14029 14284 5203e9 14283->14284 14293 5203e5 CatchIt 14283->14293 14285 5203f0 14284->14285 14288 520403 __fread_nolock 14284->14288 14286 52416e __dosmaperr 14 API calls 14285->14286 14287 5203f5 14286->14287 14289 51fb39 __fread_nolock 29 API calls 14287->14289 14290 520431 14288->14290 14291 52043a 14288->14291 14288->14293 14289->14293 14292 52416e __dosmaperr 14 API calls 14290->14292 14291->14293 14295 52416e __dosmaperr 14 API calls 14291->14295 14294 520436 14292->14294 14293->14275 14296 51fb39 __fread_nolock 29 API calls 14294->14296 14295->14294 14296->14293 14297->14282 14299 5220ca 14298->14299 14300 5220d8 14298->14300 14299->14300 14305 5220f0 14299->14305 14301 52416e __dosmaperr 14 API calls 14300->14301 14302 5220e0 14301->14302 14304 51fb39 __fread_nolock 29 API calls 14302->14304 14303 5220ea 14303->13974 14304->14303 14305->14303 14306 52416e __dosmaperr 14 API calls 14305->14306 14306->14302 14308 51f92d 14307->14308 14309 51f94a 14307->14309 14310 51f944 14308->14310 14311 5239bb __freea 14 API calls 14308->14311 14309->13975 14312 5239bb __freea 14 API calls 14310->14312 14311->14308 14312->14309 14314 526f8d 14313->14314 14315 526f9e 14314->14315 14318 526fb1 ___from_strstr_to_strchr 14314->14318 14316 52416e __dosmaperr 14 API calls 14315->14316 14326 526fa3 14316->14326 14317 5271c8 14320 52416e __dosmaperr 14 API calls 14317->14320 14318->14317 14319 526fd1 14318->14319 14376 5271ed 14319->14376 14322 5271cd 14320->14322 14324 5239bb __freea 14 API calls 14322->14324 14324->14326 14325 527015 14362 527001 14325->14362 14380 527207 14325->14380 14326->13933 14327 527017 14331 52421e _unexpected 14 API calls 14327->14331 14327->14362 14329 526ff3 14336 527010 14329->14336 14337 526ffc 14329->14337 14333 527025 14331->14333 14332 5239bb __freea 14 API calls 14332->14326 14335 5239bb __freea 14 API calls 14333->14335 14334 52708a 14339 5239bb __freea 14 API calls 14334->14339 14340 527030 14335->14340 14338 5271ed 39 API calls 14336->14338 14341 52416e __dosmaperr 14 API calls 14337->14341 14338->14325 14347 527092 14339->14347 14340->14325 14345 52421e _unexpected 14 API calls 14340->14345 14340->14362 14341->14362 14342 5270d5 14343 526d42 32 API calls 14342->14343 14342->14362 14344 527103 14343->14344 14346 5239bb __freea 14 API calls 14344->14346 14349 52704c 14345->14349 14352 5270bf 14346->14352 14347->14352 14384 526d42 14347->14384 14348 5271bd 14350 5239bb __freea 14 API calls 14348->14350 14353 5239bb __freea 14 API calls 14349->14353 14350->14326 14352->14348 14352->14352 14356 52421e _unexpected 14 API calls 14352->14356 14352->14362 14353->14325 14354 5270b6 14355 5239bb __freea 14 API calls 14354->14355 14355->14352 14357 52714e 14356->14357 14358 527156 14357->14358 14359 52715e 14357->14359 14360 5239bb __freea 14 API calls 14358->14360 14361 5220bc ___std_exception_copy 29 API calls 14359->14361 14360->14362 14363 52716a 14361->14363 14362->14332 14364 5271e2 14363->14364 14365 527171 14363->14365 14366 51fb66 std::_Throw_Cpp_error 11 API calls 14364->14366 14393 52cd7c 14365->14393 14368 5271ec 14366->14368 14370 5271b7 14372 5239bb __freea 14 API calls 14370->14372 14371 527198 14373 52416e __dosmaperr 14 API calls 14371->14373 14372->14348 14374 52719d 14373->14374 14375 5239bb __freea 14 API calls 14374->14375 14375->14362 14377 526fdc 14376->14377 14378 5271fa 14376->14378 14377->14325 14377->14327 14377->14329 14408 52725c 14378->14408 14381 52707a 14380->14381 14382 52721d 14380->14382 14381->14334 14381->14342 14382->14381 14423 52cc8b 14382->14423 14385 526d6a 14384->14385 14386 526d4f 14384->14386 14388 526d79 14385->14388 14523 52cab8 14385->14523 14386->14385 14387 526d5b 14386->14387 14389 52416e __dosmaperr 14 API calls 14387->14389 14530 52caeb 14388->14530 14392 526d60 __fread_nolock 14389->14392 14392->14354 14542 525e11 14393->14542 14398 52cdef 14402 5239bb __freea 14 API calls 14398->14402 14405 52cdfb 14398->14405 14399 525e11 __wsopen_s 39 API calls 14401 52cdcc 14399->14401 14400 527192 14400->14370 14400->14371 14404 525ea9 __wsopen_s 17 API calls 14401->14404 14402->14405 14403 5239bb __freea 14 API calls 14403->14400 14406 52cdd9 14404->14406 14405->14400 14405->14403 14406->14398 14407 52cde3 SetEnvironmentVariableW 14406->14407 14407->14398 14409 52726a 14408->14409 14410 52726f 14408->14410 14409->14377 14411 52421e _unexpected 14 API calls 14410->14411 14417 52728c 14411->14417 14412 5272fa 14413 520139 CallUnexpected 39 API calls 14412->14413 14415 5272ff 14413->14415 14414 5239bb __freea 14 API calls 14414->14409 14416 51fb66 std::_Throw_Cpp_error 11 API calls 14415->14416 14418 52730b 14416->14418 14417->14412 14417->14415 14419 52421e _unexpected 14 API calls 14417->14419 14420 5239bb __freea 14 API calls 14417->14420 14421 5220bc ___std_exception_copy 29 API calls 14417->14421 14422 5272e9 14417->14422 14419->14417 14420->14417 14421->14417 14422->14414 14424 52cc99 14423->14424 14425 52cc9f 14423->14425 14428 52ce20 14424->14428 14429 52ce68 14424->14429 14441 52ccb4 14425->14441 14431 52ce26 14428->14431 14433 52ce43 14428->14433 14461 52ce7e 14429->14461 14432 52416e __dosmaperr 14 API calls 14431->14432 14435 52ce2b 14432->14435 14437 52416e __dosmaperr 14 API calls 14433->14437 14440 52ce61 14433->14440 14434 52ce36 14434->14382 14436 51fb39 __fread_nolock 29 API calls 14435->14436 14436->14434 14438 52ce52 14437->14438 14439 51fb39 __fread_nolock 29 API calls 14438->14439 14439->14434 14440->14382 14442 5231b8 __strnicoll 39 API calls 14441->14442 14443 52ccca 14442->14443 14444 52cce6 14443->14444 14445 52ccfd 14443->14445 14458 52ccaf 14443->14458 14446 52416e __dosmaperr 14 API calls 14444->14446 14447 52cd06 14445->14447 14448 52cd18 14445->14448 14449 52cceb 14446->14449 14450 52416e __dosmaperr 14 API calls 14447->14450 14451 52cd25 14448->14451 14452 52cd38 14448->14452 14453 51fb39 __fread_nolock 29 API calls 14449->14453 14454 52cd0b 14450->14454 14455 52ce7e __strnicoll 39 API calls 14451->14455 14479 52e4c0 14452->14479 14453->14458 14457 51fb39 __fread_nolock 29 API calls 14454->14457 14455->14458 14457->14458 14458->14382 14460 52416e __dosmaperr 14 API calls 14460->14458 14462 52cea8 14461->14462 14463 52ce8e 14461->14463 14465 52ceb0 14462->14465 14466 52cec7 14462->14466 14464 52416e __dosmaperr 14 API calls 14463->14464 14469 52ce93 14464->14469 14470 52416e __dosmaperr 14 API calls 14465->14470 14467 52ced3 14466->14467 14468 52ceea 14466->14468 14471 52416e __dosmaperr 14 API calls 14467->14471 14475 5231b8 __strnicoll 39 API calls 14468->14475 14478 52ce9e 14468->14478 14472 51fb39 __fread_nolock 29 API calls 14469->14472 14473 52ceb5 14470->14473 14474 52ced8 14471->14474 14472->14478 14476 51fb39 __fread_nolock 29 API calls 14473->14476 14477 51fb39 __fread_nolock 29 API calls 14474->14477 14475->14478 14476->14478 14477->14478 14478->14434 14480 5231b8 __strnicoll 39 API calls 14479->14480 14481 52e4d3 14480->14481 14484 52e506 14481->14484 14487 52e53a __strnicoll 14484->14487 14485 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14486 52cd4e 14485->14486 14486->14458 14486->14460 14488 52e5ba 14487->14488 14489 52e79e 14487->14489 14491 52e5a7 GetCPInfo 14487->14491 14496 52e5be 14487->14496 14490 52598b __strnicoll MultiByteToWideChar 14488->14490 14488->14496 14493 52e640 14490->14493 14491->14488 14491->14496 14492 52e792 14495 52586a __freea 14 API calls 14492->14495 14493->14492 14494 524366 __strnicoll 15 API calls 14493->14494 14493->14496 14497 52e667 __strnicoll 14493->14497 14494->14497 14495->14496 14496->14485 14496->14489 14497->14492 14498 52598b __strnicoll MultiByteToWideChar 14497->14498 14499 52e6b3 14498->14499 14499->14492 14500 52598b __strnicoll MultiByteToWideChar 14499->14500 14501 52e6cf 14500->14501 14501->14492 14502 52e6dd 14501->14502 14503 524366 __strnicoll 15 API calls 14502->14503 14507 52e6f6 __strnicoll 14502->14507 14511 52e740 14502->14511 14503->14507 14504 52586a __freea 14 API calls 14505 52e746 14504->14505 14506 52586a __freea 14 API calls 14505->14506 14506->14496 14508 52598b __strnicoll MultiByteToWideChar 14507->14508 14507->14511 14509 52e739 14508->14509 14510 52e762 14509->14510 14509->14511 14517 5224c5 14510->14517 14511->14504 14514 52586a __freea 14 API calls 14515 52e782 14514->14515 14516 52586a __freea 14 API calls 14515->14516 14516->14496 14518 5228a4 __strnicoll 5 API calls 14517->14518 14519 5224d0 14518->14519 14520 5226c9 __strnicoll 5 API calls 14519->14520 14522 5224d6 14519->14522 14521 522516 CompareStringW 14520->14521 14521->14522 14522->14514 14524 52cac3 14523->14524 14525 52cad8 HeapSize 14523->14525 14526 52416e __dosmaperr 14 API calls 14524->14526 14525->14388 14527 52cac8 14526->14527 14528 51fb39 __fread_nolock 29 API calls 14527->14528 14529 52cad3 14528->14529 14529->14388 14531 52cb03 14530->14531 14532 52caf8 14530->14532 14534 52cb0b 14531->14534 14540 52cb14 _unexpected 14531->14540 14533 524366 __strnicoll 15 API calls 14532->14533 14538 52cb00 14533->14538 14535 5239bb __freea 14 API calls 14534->14535 14535->14538 14536 52cb19 14539 52416e __dosmaperr 14 API calls 14536->14539 14537 52cb3e HeapReAlloc 14537->14538 14537->14540 14538->14392 14539->14538 14540->14536 14540->14537 14541 51efe1 _unexpected 2 API calls 14540->14541 14541->14540 14543 5231b8 __strnicoll 39 API calls 14542->14543 14544 525e23 14543->14544 14545 525e35 14544->14545 14550 5224a6 14544->14550 14547 525ea9 14545->14547 14556 52607f 14547->14556 14553 52288a 14550->14553 14554 522805 _unexpected 5 API calls 14553->14554 14555 5224ae 14554->14555 14555->14545 14557 5260a7 14556->14557 14558 52608d 14556->14558 14560 5260ae 14557->14560 14561 5260cd 14557->14561 14574 525e8f 14558->14574 14566 525ec1 14560->14566 14578 525e50 14560->14578 14562 52598b __strnicoll MultiByteToWideChar 14561->14562 14563 5260dc 14562->14563 14565 5260e3 GetLastError 14563->14565 14568 526109 14563->14568 14570 525e50 __wsopen_s 15 API calls 14563->14570 14583 524194 14565->14583 14566->14398 14566->14399 14568->14566 14571 52598b __strnicoll MultiByteToWideChar 14568->14571 14570->14568 14573 526120 14571->14573 14572 52416e __dosmaperr 14 API calls 14572->14566 14573->14565 14573->14566 14575 525ea2 14574->14575 14576 525e9a 14574->14576 14575->14566 14577 5239bb __freea 14 API calls 14576->14577 14577->14575 14579 525e8f __wsopen_s 14 API calls 14578->14579 14580 525e5e 14579->14580 14588 525df2 14580->14588 14591 524181 14583->14591 14585 52419f __dosmaperr 14586 52416e __dosmaperr 14 API calls 14585->14586 14587 5241b2 14586->14587 14587->14572 14589 524366 __strnicoll 15 API calls 14588->14589 14590 525dff 14589->14590 14590->14566 14592 522acb __dosmaperr 14 API calls 14591->14592 14593 524186 14592->14593 14593->14585 14599 4fba60 std::_Throw_Cpp_error CatchIt 14594->14599 14595 4fba79 14596 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14595->14596 14597 4f809b 14596->14597 14600 5202dd 14597->14600 14598 4fc8e0 31 API calls std::_Throw_Cpp_error 14598->14599 14599->14595 14599->14598 14622 5202f4 14600->14622 15006 4f4ee0 14603->15006 14608 4e1000 79 API calls 14613 4f7e17 14608->14613 14609 4f7e7d VirtualProtect 14609->14613 14610 4f4ee0 31 API calls 14610->14613 14611 4f7ef9 14611->13785 14612 4f7e50 14614 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14612->14614 14613->14609 14613->14610 14613->14611 14613->14612 14615 4f8041 14614->14615 14615->13785 14620 4f5300 14616->14620 14617 4f7d5d 14618 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 14617->14618 14619 4f7d68 14618->14619 14619->13789 14620->14617 14621 4fa630 29 API calls std::_Throw_Cpp_error 14620->14621 14621->14620 14623 520300 ___scrt_is_nonwritable_in_current_image 14622->14623 14624 520307 14623->14624 14626 520327 14623->14626 14625 52416e __dosmaperr 14 API calls 14624->14625 14627 52030c 14625->14627 14628 520339 14626->14628 14629 52032c 14626->14629 14630 51fb39 __fread_nolock 29 API calls 14627->14630 14641 52795a 14628->14641 14631 52416e __dosmaperr 14 API calls 14629->14631 14633 5202ef 14630->14633 14631->14633 14633->13785 14635 520356 14649 527ac0 14635->14649 14636 520349 14637 52416e __dosmaperr 14 API calls 14636->14637 14637->14633 14642 527966 ___scrt_is_nonwritable_in_current_image 14641->14642 14659 51fe41 EnterCriticalSection 14642->14659 14644 527974 14660 5279fe 14644->14660 14650 527bdf 14649->14650 14685 527c62 14650->14685 14653 52036b 14655 520394 14653->14655 14658 520398 14655->14658 14657 5203a9 14657->14633 15005 51cd03 LeaveCriticalSection 14658->15005 14659->14644 14664 527a21 14660->14664 14661 527981 14673 5279ba 14661->14673 14662 527a79 14663 52421e _unexpected 14 API calls 14662->14663 14665 527a82 14663->14665 14664->14661 14664->14662 14676 51ccef EnterCriticalSection 14664->14676 14677 51cd03 LeaveCriticalSection 14664->14677 14667 5239bb __freea 14 API calls 14665->14667 14668 527a8b 14667->14668 14668->14661 14678 522621 14668->14678 14684 51fe58 LeaveCriticalSection 14673->14684 14675 520342 14675->14635 14675->14636 14676->14664 14677->14664 14679 522805 _unexpected 5 API calls 14678->14679 14680 52263d 14679->14680 14681 52265b InitializeCriticalSectionAndSpinCount 14680->14681 14682 522646 14680->14682 14681->14682 14683 51ccef EnterCriticalSection 14682->14683 14683->14661 14684->14675 14686 527c81 14685->14686 14687 527c94 14686->14687 14695 527ca9 14686->14695 14688 52416e __dosmaperr 14 API calls 14687->14688 14689 527c99 14688->14689 14690 51fb39 __fread_nolock 29 API calls 14689->14690 14691 527bf5 14690->14691 14691->14653 14702 52cf49 14691->14702 14692 52416e __dosmaperr 14 API calls 14693 527e7a 14692->14693 14694 51fb39 __fread_nolock 29 API calls 14693->14694 14694->14691 14700 527dc9 14695->14700 14705 52ce11 14695->14705 14697 527e19 14698 52ce11 39 API calls 14697->14698 14697->14700 14699 527e37 14698->14699 14699->14700 14701 52ce11 39 API calls 14699->14701 14700->14691 14700->14692 14701->14700 14719 52d301 14702->14719 14706 52ce20 14705->14706 14707 52ce68 14705->14707 14709 52ce26 14706->14709 14711 52ce43 14706->14711 14708 52ce7e __strnicoll 39 API calls 14707->14708 14712 52ce36 14708->14712 14710 52416e __dosmaperr 14 API calls 14709->14710 14713 52ce2b 14710->14713 14715 52416e __dosmaperr 14 API calls 14711->14715 14718 52ce61 14711->14718 14712->14697 14714 51fb39 __fread_nolock 29 API calls 14713->14714 14714->14712 14716 52ce52 14715->14716 14717 51fb39 __fread_nolock 29 API calls 14716->14717 14717->14712 14718->14697 14721 52d30d ___scrt_is_nonwritable_in_current_image 14719->14721 14720 52d314 14722 52416e __dosmaperr 14 API calls 14720->14722 14721->14720 14723 52d33f 14721->14723 14724 52d319 14722->14724 14730 52cf69 14723->14730 14726 51fb39 __fread_nolock 29 API calls 14724->14726 14729 52cf64 14726->14729 14729->14653 14731 525e11 __wsopen_s 39 API calls 14730->14731 14732 52cf8b 14731->14732 14733 525ea9 __wsopen_s 17 API calls 14732->14733 14734 52cf98 14733->14734 14735 52cf9f 14734->14735 14743 52cfd7 14734->14743 14737 52cfd1 14735->14737 14738 5239bb __freea 14 API calls 14735->14738 14739 52d396 14737->14739 14738->14737 14740 52d39c 14739->14740 14742 52d3da 14739->14742 15004 52771d LeaveCriticalSection 14740->15004 14742->14729 14790 52d471 14743->14790 14746 52d022 14808 527376 14746->14808 14747 52d009 14748 524181 __dosmaperr 14 API calls 14747->14748 14762 52d00e 14748->14762 14751 52d030 14753 524181 __dosmaperr 14 API calls 14751->14753 14752 52d047 14821 52d3dc CreateFileW 14752->14821 14756 52d035 14753->14756 14755 52416e __dosmaperr 14 API calls 14757 52d01b 14755->14757 14758 52416e __dosmaperr 14 API calls 14756->14758 14757->14735 14758->14762 14759 52d0fd GetFileType 14760 52d108 GetLastError 14759->14760 14761 52d14f 14759->14761 14764 524194 __dosmaperr 14 API calls 14760->14764 14823 52751a 14761->14823 14762->14755 14763 52d0d2 GetLastError 14766 524194 __dosmaperr 14 API calls 14763->14766 14767 52d116 CloseHandle 14764->14767 14765 52d080 14765->14759 14765->14763 14822 52d3dc CreateFileW 14765->14822 14766->14762 14767->14762 14769 52d13f 14767->14769 14772 52416e __dosmaperr 14 API calls 14769->14772 14771 52d0c5 14771->14759 14771->14763 14774 52d144 14772->14774 14774->14762 14775 52d1bc 14779 52d1c3 14775->14779 14851 52d695 14775->14851 14847 527756 14779->14847 14780 52d1ff 14780->14757 14782 52d27b CloseHandle 14780->14782 14878 52d3dc CreateFileW 14782->14878 14784 52d2a6 14785 52d2dc 14784->14785 14786 52d2b0 GetLastError 14784->14786 14785->14757 14787 524194 __dosmaperr 14 API calls 14786->14787 14788 52d2bc 14787->14788 14879 527489 14788->14879 14791 52d492 14790->14791 14792 52d4ac 14790->14792 14791->14792 14794 52416e __dosmaperr 14 API calls 14791->14794 14888 52d401 14792->14888 14795 52d4a1 14794->14795 14796 51fb39 __fread_nolock 29 API calls 14795->14796 14796->14792 14797 52d4e4 14798 52d513 14797->14798 14800 52416e __dosmaperr 14 API calls 14797->14800 14801 52cff4 14798->14801 14895 520007 14798->14895 14803 52d508 14800->14803 14801->14746 14801->14747 14802 52d561 14802->14801 14805 52d5de 14802->14805 14804 51fb39 __fread_nolock 29 API calls 14803->14804 14804->14798 14806 51fb66 std::_Throw_Cpp_error 11 API calls 14805->14806 14807 52d5ea 14806->14807 14809 527382 ___scrt_is_nonwritable_in_current_image 14808->14809 14902 51fe41 EnterCriticalSection 14809->14902 14811 527389 14812 5273ae 14811->14812 14817 52741d EnterCriticalSection 14811->14817 14820 5273d0 14811->14820 14906 5275ac 14812->14906 14819 52742a LeaveCriticalSection 14817->14819 14817->14820 14819->14811 14903 527480 14820->14903 14821->14765 14822->14771 14824 527592 14823->14824 14825 527529 14823->14825 14826 52416e __dosmaperr 14 API calls 14824->14826 14825->14824 14831 52754f __wsopen_s 14825->14831 14827 527597 14826->14827 14828 524181 __dosmaperr 14 API calls 14827->14828 14829 52757f 14828->14829 14829->14775 14832 52d5eb 14829->14832 14830 527579 SetStdHandle 14830->14829 14831->14829 14831->14830 14833 52d613 14832->14833 14843 52d645 14832->14843 14833->14843 14914 528c3e 14833->14914 14835 52d623 14836 52d633 14835->14836 14837 52d649 14835->14837 14838 524181 __dosmaperr 14 API calls 14836->14838 14918 5281fd 14837->14918 14845 52d638 14838->14845 14840 52416e __dosmaperr 14 API calls 14840->14843 14842 528c3e __fread_nolock 31 API calls 14842->14845 14843->14775 14845->14840 14845->14843 14846 52d671 14846->14842 14846->14845 14848 527769 __fread_nolock 14847->14848 14987 527786 14848->14987 14850 527775 __fread_nolock 14850->14757 14852 52d6c6 14851->14852 14872 52d1f1 14851->14872 14853 520007 __wsopen_s 29 API calls 14852->14853 14857 52d6e6 14852->14857 14854 52d6dd 14853->14854 14855 52d8e0 14854->14855 14854->14857 14856 51fb66 std::_Throw_Cpp_error 11 API calls 14855->14856 14858 52d8ea 14856->14858 14860 528c3e __fread_nolock 31 API calls 14857->14860 14864 52d7a7 14857->14864 14857->14872 14877 52d7d6 14857->14877 14859 5281fd __fread_nolock 41 API calls 14866 52d806 14859->14866 14863 52d7c0 14860->14863 14862 52d7e0 14865 52416e __dosmaperr 14 API calls 14862->14865 14862->14872 14863->14864 14870 52d7cb 14863->14870 14864->14862 14864->14872 15000 52965e 14864->15000 14865->14872 14866->14862 14867 52d871 14866->14867 14868 52d84b 14866->14868 14869 52d83e 14866->14869 14866->14872 14873 528c3e __fread_nolock 31 API calls 14867->14873 14868->14867 14871 52d853 14868->14871 14874 52416e __dosmaperr 14 API calls 14869->14874 14875 528c3e __fread_nolock 31 API calls 14870->14875 14876 528c3e __fread_nolock 31 API calls 14871->14876 14872->14779 14872->14780 14873->14862 14874->14862 14875->14877 14876->14862 14877->14859 14877->14862 14877->14872 14878->14784 14880 527498 14879->14880 14881 5274ff 14879->14881 14880->14881 14887 5274c2 __wsopen_s 14880->14887 14882 52416e __dosmaperr 14 API calls 14881->14882 14883 527504 14882->14883 14884 524181 __dosmaperr 14 API calls 14883->14884 14885 5274ef 14884->14885 14885->14785 14886 5274e9 SetStdHandle 14886->14885 14887->14885 14887->14886 14891 52d419 14888->14891 14889 52d434 14889->14797 14890 52416e __dosmaperr 14 API calls 14892 52d458 14890->14892 14891->14889 14891->14890 14893 51fb39 __fread_nolock 29 API calls 14892->14893 14894 52d463 14893->14894 14894->14797 14896 520013 14895->14896 14897 520028 14895->14897 14898 52416e __dosmaperr 14 API calls 14896->14898 14897->14802 14899 520018 14898->14899 14900 51fb39 __fread_nolock 29 API calls 14899->14900 14901 520023 14900->14901 14901->14802 14902->14811 14904 51fe58 CallUnexpected LeaveCriticalSection 14903->14904 14905 5273f0 14904->14905 14905->14751 14905->14752 14907 52421e _unexpected 14 API calls 14906->14907 14908 5275be 14907->14908 14911 522621 __wsopen_s 6 API calls 14908->14911 14912 5275cb 14908->14912 14909 5239bb __freea 14 API calls 14910 5273b3 14909->14910 14910->14820 14913 5276fa EnterCriticalSection 14910->14913 14911->14908 14912->14909 14913->14820 14915 528c52 __fread_nolock 14914->14915 14916 528ddf __fread_nolock 31 API calls 14915->14916 14917 528c67 __fread_nolock 14916->14917 14917->14835 14919 528227 14918->14919 14920 52820f 14918->14920 14922 528569 14919->14922 14927 52826a 14919->14927 14921 524181 __dosmaperr 14 API calls 14920->14921 14923 528214 14921->14923 14924 524181 __dosmaperr 14 API calls 14922->14924 14925 52416e __dosmaperr 14 API calls 14923->14925 14926 52856e 14924->14926 14931 52821c 14925->14931 14928 52416e __dosmaperr 14 API calls 14926->14928 14929 528275 14927->14929 14927->14931 14935 5282a5 14927->14935 14932 528282 14928->14932 14930 524181 __dosmaperr 14 API calls 14929->14930 14933 52827a 14930->14933 14931->14846 14983 52e811 14931->14983 14936 51fb39 __fread_nolock 29 API calls 14932->14936 14934 52416e __dosmaperr 14 API calls 14933->14934 14934->14932 14937 5282be 14935->14937 14938 5282cb 14935->14938 14939 5282f9 14935->14939 14936->14931 14937->14938 14943 5282e7 14937->14943 14940 524181 __dosmaperr 14 API calls 14938->14940 14941 524366 __strnicoll 15 API calls 14939->14941 14942 5282d0 14940->14942 14944 52830a 14941->14944 14945 52416e __dosmaperr 14 API calls 14942->14945 14946 52a164 __fread_nolock 29 API calls 14943->14946 14948 5239bb __freea 14 API calls 14944->14948 14949 5282d7 14945->14949 14947 528445 14946->14947 14950 5284b9 14947->14950 14953 52845e GetConsoleMode 14947->14953 14951 528313 14948->14951 14952 51fb39 __fread_nolock 29 API calls 14949->14952 14955 5284bd ReadFile 14950->14955 14954 5239bb __freea 14 API calls 14951->14954 14980 5282e2 __fread_nolock 14952->14980 14953->14950 14958 52846f 14953->14958 14959 52831a 14954->14959 14956 528531 GetLastError 14955->14956 14957 5284d5 14955->14957 14960 528495 14956->14960 14961 52853e 14956->14961 14957->14956 14962 5284ae 14957->14962 14958->14955 14963 528475 ReadConsoleW 14958->14963 14964 528324 14959->14964 14965 52833f 14959->14965 14972 524194 __dosmaperr 14 API calls 14960->14972 14960->14980 14966 52416e __dosmaperr 14 API calls 14961->14966 14975 528511 14962->14975 14976 5284fa 14962->14976 14962->14980 14963->14962 14968 52848f GetLastError 14963->14968 14970 52416e __dosmaperr 14 API calls 14964->14970 14967 528c3e __fread_nolock 31 API calls 14965->14967 14971 528543 14966->14971 14967->14943 14968->14960 14969 5239bb __freea 14 API calls 14969->14931 14973 528329 14970->14973 14974 524181 __dosmaperr 14 API calls 14971->14974 14972->14980 14977 524181 __dosmaperr 14 API calls 14973->14977 14974->14980 14979 52852a 14975->14979 14975->14980 14978 528606 __fread_nolock 34 API calls 14976->14978 14977->14980 14978->14980 14981 5288aa __fread_nolock 32 API calls 14979->14981 14980->14969 14982 52852f 14981->14982 14982->14980 14984 52e824 __fread_nolock 14983->14984 14985 52e848 __wsopen_s 64 API calls 14984->14985 14986 52e836 __fread_nolock 14985->14986 14986->14846 14988 52730c __wsopen_s 29 API calls 14987->14988 14989 527796 14988->14989 14990 52779c 14989->14990 14992 5277ce 14989->14992 14994 52730c __wsopen_s 29 API calls 14989->14994 14991 527489 __wsopen_s 15 API calls 14990->14991 14999 5277f4 __wsopen_s 14991->14999 14992->14990 14993 52730c __wsopen_s 29 API calls 14992->14993 14995 5277da CloseHandle 14993->14995 14996 5277c5 14994->14996 14995->14990 14997 5277e6 GetLastError 14995->14997 14998 52730c __wsopen_s 29 API calls 14996->14998 14997->14990 14998->14992 14999->14850 15001 529671 __fread_nolock 15000->15001 15002 5298b1 __wsopen_s 64 API calls 15001->15002 15003 529683 __fread_nolock 15002->15003 15003->14864 15004->14742 15005->14657 15010 4f4f30 15006->15010 15007 4fb600 std::_Throw_Cpp_error 31 API calls 15007->15010 15008 4f5170 29 API calls 15008->15010 15009 4f5096 15012 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15009->15012 15010->15007 15010->15008 15010->15009 15033 4ee1f0 15010->15033 15013 4f515c FreeConsole 15012->15013 15014 4e1000 15013->15014 15031 4e1050 15014->15031 15015 4eac4c 15017 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15015->15017 15018 4eac5a 15017->15018 15018->14608 15019 4eac70 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15019->15031 15020 4e7ba7 15133 5211ab 15020->15133 15021 4fa630 std::_Throw_Cpp_error 29 API calls 15021->15031 15023 506d50 31 API calls 15023->15031 15024 506320 29 API calls 15024->15031 15027 4ec070 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15027->15031 15028 51a366 9 API calls std::_Throw_Cpp_error 15028->15031 15029 4ed580 72 API calls 15029->15031 15030 510300 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15030->15031 15031->15015 15031->15019 15031->15020 15031->15021 15031->15023 15031->15024 15031->15027 15031->15028 15031->15029 15031->15030 15032 512820 31 API calls 15031->15032 15112 50b9e0 15031->15112 15119 4ee0c0 15031->15119 15032->15031 15039 4ee240 15033->15039 15034 4f0afc 15035 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15034->15035 15038 4f4ecf 15035->15038 15036 506320 29 API calls 15036->15039 15038->15010 15039->15034 15039->15036 15040 506d50 15039->15040 15046 507120 15040->15046 15041 5073e6 15069 509a60 15041->15069 15042 50acb0 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15042->15046 15043 507319 15075 507420 15043->15075 15046->15041 15046->15042 15046->15043 15053 507740 15046->15053 15057 508910 15046->15057 15049 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15051 507408 15049->15051 15051->15039 15054 507d00 15053->15054 15055 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15054->15055 15056 508903 15055->15056 15056->15046 15058 508cc0 15057->15058 15059 508d09 15058->15059 15061 5091df 15058->15061 15060 502ad0 std::_Throw_Cpp_error 6 API calls 15059->15060 15062 509a56 15060->15062 15063 51a366 std::_Throw_Cpp_error 9 API calls 15061->15063 15064 5095d0 15061->15064 15065 500af0 std::_Throw_Cpp_error 31 API calls 15061->15065 15067 509a17 15061->15067 15063->15061 15066 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15064->15066 15065->15061 15068 509a44 15066->15068 15067->15046 15068->15046 15071 509e40 15069->15071 15070 50ac94 15073 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15070->15073 15071->15070 15079 4fa630 15071->15079 15074 5073f9 15073->15074 15074->15049 15076 50762e 15075->15076 15087 51aa5c 15076->15087 15081 4fa660 15079->15081 15080 4fb5cb std::_Throw_Cpp_error 15082 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15080->15082 15081->15080 15084 4fb02d 15081->15084 15083 4fb5e6 15082->15083 15083->15071 15085 51fb49 std::_Throw_Cpp_error 29 API calls 15084->15085 15086 4fb5f3 15085->15086 15094 51aa9b 15087->15094 15090 51bbec CallUnexpected RaiseException 15091 51aa7b 15090->15091 15097 503680 15091->15097 15103 51a3e1 15094->15103 15099 503930 15097->15099 15098 50439e 15101 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15098->15101 15099->15098 15100 51c1dd 29 API calls ___std_exception_copy 15099->15100 15100->15099 15102 5043a9 15101->15102 15106 51c1dd 15103->15106 15108 51c1ea ___std_exception_copy 15106->15108 15111 51a40d 15106->15111 15107 51c217 15109 5206ec ___vcrt_freefls@4 14 API calls 15107->15109 15108->15107 15110 5220bc ___std_exception_copy 29 API calls 15108->15110 15108->15111 15109->15111 15110->15107 15111->15090 15116 50ba10 15112->15116 15113 50c849 15117 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15113->15117 15115 50c8e0 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15115->15116 15116->15113 15116->15115 15139 50e9f0 15116->15139 15118 50c8c8 15117->15118 15118->15031 15120 4ee0e1 15119->15120 15121 4ee1af 15120->15121 15122 4ee0fa GetCurrentThreadId 15120->15122 15123 4ee1dc 15120->15123 15127 4ee194 15120->15127 15128 4ee1a8 15120->15128 15151 51aadb WaitForSingleObjectEx 15120->15151 15124 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15121->15124 15122->15120 15126 51a62d std::_Throw_Cpp_error 32 API calls 15123->15126 15129 4ee1cd 15124->15129 15130 4ee1e3 15126->15130 15132 51a62d std::_Throw_Cpp_error 32 API calls 15127->15132 15156 51a62d 15128->15156 15129->15031 15132->15123 15134 5211b7 ___scrt_is_nonwritable_in_current_image 15133->15134 15135 52297a _unexpected 39 API calls 15134->15135 15136 5211bc 15135->15136 15137 520139 CallUnexpected 39 API calls 15136->15137 15138 5211e6 15137->15138 15144 50efb0 15139->15144 15140 5102cb 15141 509a60 29 API calls 15140->15141 15146 5102e0 15141->15146 15142 50acb0 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15142->15144 15143 5102c6 15147 507420 30 API calls 15143->15147 15144->15140 15144->15142 15144->15143 15145 507740 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15144->15145 15148 508910 31 API calls 15144->15148 15145->15144 15149 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15146->15149 15147->15140 15148->15144 15150 5102ef 15149->15150 15150->15116 15152 51aaf1 GetExitCodeThread 15151->15152 15153 51ab23 15151->15153 15152->15153 15154 51ab02 CloseHandle 15152->15154 15153->15120 15154->15120 15157 51a643 std::_Throw_Cpp_error 15156->15157 15162 51a88d 15157->15162 15163 51a899 __EH_prolog3_GS 15162->15163 15172 51a431 15163->15172 15165 51a8ad 15176 51a7b6 15165->15176 15173 51a43d __EH_prolog3 15172->15173 15174 4fb600 std::_Throw_Cpp_error 31 API calls 15173->15174 15175 51a459 std::_Throw_Cpp_error 15174->15175 15175->15165 15192 51a4ca 15176->15192 15178 51a7e7 15196 51a743 15178->15196 15181 51a588 std::_Throw_Cpp_error 29 API calls 15182 51a809 15181->15182 15183 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15182->15183 15184 51a828 15183->15184 15185 51a588 15184->15185 15186 51a593 15185->15186 15187 51a59c 15185->15187 15188 4fa630 std::_Throw_Cpp_error 29 API calls 15186->15188 15189 51ad62 15187->15189 15188->15187 15190 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 15189->15190 15191 51ad6c 15190->15191 15191->15191 15193 51a4e2 15192->15193 15195 51a4e9 CatchIt 15193->15195 15208 51aa1e 15193->15208 15195->15178 15197 51a74f __EH_prolog3_GS 15196->15197 15199 51a76e std::_Throw_Cpp_error 15197->15199 15215 51a532 15197->15215 15200 51a532 std::_Throw_Cpp_error 31 API calls 15199->15200 15201 51a793 15200->15201 15202 51a588 std::_Throw_Cpp_error 29 API calls 15201->15202 15203 51a79b std::_Throw_Cpp_error 15202->15203 15204 51a588 std::_Throw_Cpp_error 29 API calls 15203->15204 15205 51a7ae 15204->15205 15206 51ad62 std::_Throw_Cpp_error 5 API calls 15205->15206 15207 51a7b5 std::domain_error::domain_error 15206->15207 15207->15181 15209 51aa34 15208->15209 15210 51aa2b 15208->15210 15211 51aa40 15209->15211 15213 51a366 std::_Throw_Cpp_error 9 API calls 15209->15213 15212 500af0 std::_Throw_Cpp_error 31 API calls 15210->15212 15211->15195 15214 51aa31 15212->15214 15213->15214 15214->15195 15216 51a573 15215->15216 15218 51a549 CatchIt 15215->15218 15219 51a95d 15216->15219 15218->15199 15220 51a982 15219->15220 15221 51aa18 15219->15221 15222 4ff4e0 std::_Throw_Cpp_error 5 API calls 15220->15222 15223 4ff4d0 std::_Throw_Cpp_error 30 API calls 15221->15223 15224 51a993 15222->15224 15225 51aa1d 15223->15225 15226 51aa1e std::_Throw_Cpp_error 31 API calls 15224->15226 15228 51a99e CatchIt 15226->15228 15227 51a9ea CatchIt 15227->15218 15228->15227 15229 4fa630 std::_Throw_Cpp_error 29 API calls 15228->15229 15229->15227 15231 51ee27 15230->15231 15232 51ee38 15230->15232 15234 51b5e9 CallUnexpected GetModuleHandleW 15231->15234 15246 51ef94 15232->15246 15236 51ee2c 15234->15236 15236->15232 15241 51ed2e GetModuleHandleExW 15236->15241 15237 51ece6 15237->13757 15242 51ed6d GetProcAddress 15241->15242 15243 51ed81 15241->15243 15242->15243 15244 51ed94 FreeLibrary 15243->15244 15245 51ed9d 15243->15245 15244->15245 15245->15232 15247 51efa0 ___scrt_is_nonwritable_in_current_image 15246->15247 15261 51fe41 EnterCriticalSection 15247->15261 15249 51efaa 15262 51ee91 15249->15262 15251 51efb7 15266 51efd5 15251->15266 15254 51edc9 15291 51edb0 15254->15291 15256 51edd3 15257 51ede7 15256->15257 15258 51edd7 GetCurrentProcess TerminateProcess 15256->15258 15259 51ed2e CallUnexpected 3 API calls 15257->15259 15258->15257 15260 51edef ExitProcess 15259->15260 15261->15249 15263 51ee9d ___scrt_is_nonwritable_in_current_image CallUnexpected 15262->15263 15264 51ef01 CallUnexpected 15263->15264 15269 51f53b 15263->15269 15264->15251 15290 51fe58 LeaveCriticalSection 15266->15290 15268 51ee70 15268->15237 15268->15254 15270 51f547 __EH_prolog3 15269->15270 15273 51f7c6 15270->15273 15272 51f56e std::_Throw_Cpp_error 15272->15264 15274 51f7d2 ___scrt_is_nonwritable_in_current_image 15273->15274 15281 51fe41 EnterCriticalSection 15274->15281 15276 51f7e0 15282 51f691 15276->15282 15281->15276 15283 51f6a8 15282->15283 15285 51f6b0 15282->15285 15286 51f815 15283->15286 15284 5239bb __freea 14 API calls 15284->15283 15285->15283 15285->15284 15289 51fe58 LeaveCriticalSection 15286->15289 15288 51f7fe 15288->15272 15289->15288 15290->15268 15294 525574 15291->15294 15293 51edb5 CallUnexpected 15293->15256 15295 525583 CallUnexpected 15294->15295 15296 525590 15295->15296 15298 5226fa 15295->15298 15296->15293 15299 522805 _unexpected 5 API calls 15298->15299 15300 522716 15299->15300 15300->15296 15302 51cc6d 15301->15302 15303 51cc7f ___scrt_uninitialize_crt 15301->15303 15304 51cc7b 15302->15304 15306 523d97 15302->15306 15303->13807 15304->13807 15309 523ec2 15306->15309 15312 523f9b 15309->15312 15313 523fa7 ___scrt_is_nonwritable_in_current_image 15312->15313 15320 51fe41 EnterCriticalSection 15313->15320 15315 52401d 15329 52403b 15315->15329 15317 523fb1 ___scrt_uninitialize_crt 15317->15315 15321 523f0f 15317->15321 15320->15317 15322 523f1b ___scrt_is_nonwritable_in_current_image 15321->15322 15332 51ccef EnterCriticalSection 15322->15332 15324 523f5e 15344 523f8f 15324->15344 15325 523f25 ___scrt_uninitialize_crt 15325->15324 15333 523da0 15325->15333 15445 51fe58 LeaveCriticalSection 15329->15445 15331 523d9e 15331->15304 15332->15325 15334 523db5 __fread_nolock 15333->15334 15335 523dc7 15334->15335 15336 523dbc 15334->15336 15347 523e05 15335->15347 15338 523ec2 ___scrt_uninitialize_crt 68 API calls 15336->15338 15341 523dc2 __fread_nolock 15338->15341 15341->15324 15342 523de8 15360 52953f 15342->15360 15444 51cd03 LeaveCriticalSection 15344->15444 15346 523f7d 15346->15317 15348 523dd1 15347->15348 15349 523e1e 15347->15349 15348->15341 15353 525538 15348->15353 15349->15348 15350 525538 __fread_nolock 29 API calls 15349->15350 15351 523e3a 15350->15351 15371 5298b1 15351->15371 15354 525544 15353->15354 15355 525559 15353->15355 15356 52416e __dosmaperr 14 API calls 15354->15356 15355->15342 15357 525549 15356->15357 15358 51fb39 __fread_nolock 29 API calls 15357->15358 15359 525554 15358->15359 15359->15342 15361 529550 15360->15361 15362 52955d 15360->15362 15363 52416e __dosmaperr 14 API calls 15361->15363 15364 5295a6 15362->15364 15366 529584 15362->15366 15370 529555 15363->15370 15365 52416e __dosmaperr 14 API calls 15364->15365 15367 5295ab 15365->15367 15414 5295bc 15366->15414 15369 51fb39 __fread_nolock 29 API calls 15367->15369 15369->15370 15370->15341 15372 5298bd ___scrt_is_nonwritable_in_current_image 15371->15372 15373 5298fe 15372->15373 15375 529944 15372->15375 15381 5298c5 15372->15381 15374 51fce2 __fread_nolock 29 API calls 15373->15374 15374->15381 15382 5276fa EnterCriticalSection 15375->15382 15377 52994a 15378 529968 15377->15378 15383 529695 15377->15383 15411 5299ba 15378->15411 15381->15348 15382->15377 15384 5296bd 15383->15384 15387 5296e0 __wsopen_s 15383->15387 15385 5296c1 15384->15385 15388 52971c 15384->15388 15386 51fce2 __fread_nolock 29 API calls 15385->15386 15386->15387 15387->15378 15389 52973a 15388->15389 15391 528c7e __wsopen_s 31 API calls 15388->15391 15390 5299c2 __wsopen_s 40 API calls 15389->15390 15392 52974c 15390->15392 15391->15389 15393 529752 15392->15393 15394 529799 15392->15394 15395 529781 15393->15395 15398 52975a 15393->15398 15396 529802 WriteFile 15394->15396 15397 5297ad 15394->15397 15399 529a3f __wsopen_s 45 API calls 15395->15399 15400 529824 GetLastError 15396->15400 15410 529794 15396->15410 15401 5297b5 15397->15401 15402 5297ee 15397->15402 15398->15387 15405 529e06 __wsopen_s 6 API calls 15398->15405 15399->15410 15400->15410 15403 5297da 15401->15403 15404 5297ba 15401->15404 15406 529e6e __wsopen_s 7 API calls 15402->15406 15408 52a032 __wsopen_s 8 API calls 15403->15408 15404->15387 15407 5297c3 15404->15407 15405->15387 15406->15387 15409 529f49 __wsopen_s 7 API calls 15407->15409 15408->15410 15409->15387 15410->15387 15412 52771d __wsopen_s LeaveCriticalSection 15411->15412 15413 5299c0 15412->15413 15413->15381 15415 5295c8 ___scrt_is_nonwritable_in_current_image 15414->15415 15427 5276fa EnterCriticalSection 15415->15427 15417 5295d7 15425 52961c 15417->15425 15428 52730c 15417->15428 15419 52416e __dosmaperr 14 API calls 15421 529623 15419->15421 15420 529603 FlushFileBuffers 15420->15421 15422 52960f GetLastError 15420->15422 15441 529652 15421->15441 15423 524181 __dosmaperr 14 API calls 15422->15423 15423->15425 15425->15419 15427->15417 15429 527319 15428->15429 15431 52732e 15428->15431 15430 524181 __dosmaperr 14 API calls 15429->15430 15433 52731e 15430->15433 15432 524181 __dosmaperr 14 API calls 15431->15432 15435 527353 15431->15435 15436 52735e 15432->15436 15434 52416e __dosmaperr 14 API calls 15433->15434 15437 527326 15434->15437 15435->15420 15438 52416e __dosmaperr 14 API calls 15436->15438 15437->15420 15439 527366 15438->15439 15440 51fb39 __fread_nolock 29 API calls 15439->15440 15440->15437 15442 52771d __wsopen_s LeaveCriticalSection 15441->15442 15443 52963b 15442->15443 15443->15370 15444->15346 15445->15331 13480 508910 13481 508cc0 13480->13481 13482 508d09 13481->13482 13484 5091df 13481->13484 13525 502ad0 13482->13525 13487 5095d0 13484->13487 13490 509a17 13484->13490 13492 51a366 13484->13492 13507 500af0 13484->13507 13518 51a3d3 13487->13518 13491 509a44 13494 51a36b ___std_exception_copy 13492->13494 13493 51a385 13493->13484 13494->13493 13497 51a387 std::_Throw_Cpp_error 13494->13497 13530 51efe1 13494->13530 13502 51ab4a 13497->13502 13533 51bbec 13497->13533 13499 51bbec CallUnexpected RaiseException 13501 51ab67 IsProcessorFeaturePresent 13499->13501 13504 51ab7d 13501->13504 13536 502af0 13502->13536 13540 51ac62 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 13504->13540 13506 51ac60 13506->13484 13508 501070 13507->13508 13509 51a366 std::_Throw_Cpp_error 9 API calls 13508->13509 13510 502aac 13508->13510 13511 502aa7 13508->13511 13512 5021ad 13508->13512 13509->13508 13513 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 13510->13513 13514 502ad0 std::_Throw_Cpp_error 6 API calls 13511->13514 13552 51fb49 13512->13552 13515 502abb 13513->13515 13514->13510 13515->13484 13519 51a3db 13518->13519 13520 51a3dc IsProcessorFeaturePresent 13518->13520 13519->13491 13522 51ab7d 13520->13522 13734 51ac62 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 13522->13734 13524 51ac60 13524->13491 13526 502af0 std::_Throw_Cpp_error 5 API calls 13525->13526 13527 502add 13526->13527 13528 51bbec CallUnexpected RaiseException 13527->13528 13529 502ae8 13528->13529 13541 51f01c 13530->13541 13534 51bc33 RaiseException 13533->13534 13535 51bc06 13533->13535 13534->13502 13535->13534 13537 502f50 13536->13537 13538 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 13537->13538 13539 50362e 13538->13539 13539->13499 13540->13506 13542 51f028 ___scrt_is_nonwritable_in_current_image 13541->13542 13547 51fe41 EnterCriticalSection 13542->13547 13544 51f033 CallUnexpected 13548 51f06a 13544->13548 13547->13544 13551 51fe58 LeaveCriticalSection 13548->13551 13550 51efec 13550->13494 13551->13550 13557 51fd88 13552->13557 13554 51fb58 13561 51fb66 IsProcessorFeaturePresent 13554->13561 13556 51fb65 13558 51fd9a __fread_nolock 13557->13558 13565 51fce2 13558->13565 13560 51fdb2 __fread_nolock 13560->13554 13562 51fb72 13561->13562 13728 51fb9a 13562->13728 13566 51fcf2 13565->13566 13567 51fcf9 13565->13567 13574 51d1a0 GetLastError 13566->13574 13572 51fd07 13567->13572 13578 51fd5f 13567->13578 13570 51fd2e 13571 51fb66 std::_Throw_Cpp_error 11 API calls 13570->13571 13570->13572 13573 51fd5e 13571->13573 13572->13560 13575 51d1b9 13574->13575 13581 522b7c 13575->13581 13577 51d1d5 SetLastError 13577->13567 13579 51fd83 13578->13579 13580 51fd6a GetLastError SetLastError 13578->13580 13579->13570 13580->13570 13582 522b8f 13581->13582 13587 522b95 13581->13587 13603 5225a0 13582->13603 13586 522b9b 13586->13577 13587->13586 13608 5225df 13587->13608 13590 522bc7 13592 5225df _unexpected 6 API calls 13590->13592 13591 522bdc 13593 5225df _unexpected 6 API calls 13591->13593 13594 522bd3 13592->13594 13595 522be8 13593->13595 13620 5239bb 13594->13620 13596 522bfb 13595->13596 13597 522bec 13595->13597 13626 522c8c 13596->13626 13600 5225df _unexpected 6 API calls 13597->13600 13600->13594 13602 5239bb __freea 14 API calls 13602->13586 13631 522805 13603->13631 13606 5225d7 TlsGetValue 13607 5225c5 13607->13587 13609 522805 _unexpected 5 API calls 13608->13609 13610 5225fb 13609->13610 13611 522604 13610->13611 13612 522619 TlsSetValue 13610->13612 13611->13586 13613 52421e 13611->13613 13614 52422b _unexpected 13613->13614 13615 52426b 13614->13615 13616 524256 RtlAllocateHeap 13614->13616 13619 51efe1 _unexpected 2 API calls 13614->13619 13646 52416e 13615->13646 13616->13614 13617 522bbf 13616->13617 13617->13590 13617->13591 13619->13614 13621 5239c6 HeapFree 13620->13621 13625 5239f0 13620->13625 13622 5239db GetLastError 13621->13622 13621->13625 13623 5239e8 __dosmaperr 13622->13623 13624 52416e __dosmaperr 12 API calls 13623->13624 13624->13625 13625->13586 13672 522df2 13626->13672 13632 522835 13631->13632 13636 5225bc 13631->13636 13632->13636 13638 52273a 13632->13638 13635 52284f GetProcAddress 13635->13636 13637 52285f _unexpected 13635->13637 13636->13606 13636->13607 13637->13636 13644 52274b ___vcrt_FlsSetValue 13638->13644 13639 5227e1 13639->13635 13639->13636 13640 522769 LoadLibraryExW 13641 522784 GetLastError 13640->13641 13642 5227e8 13640->13642 13641->13644 13642->13639 13643 5227fa FreeLibrary 13642->13643 13643->13639 13644->13639 13644->13640 13645 5227b7 LoadLibraryExW 13644->13645 13645->13642 13645->13644 13649 522acb GetLastError 13646->13649 13648 524173 13648->13617 13650 522ae1 13649->13650 13651 522ae7 13649->13651 13652 5225a0 _unexpected 6 API calls 13650->13652 13653 5225df _unexpected 6 API calls 13651->13653 13654 522aeb SetLastError 13651->13654 13652->13651 13655 522b03 13653->13655 13654->13648 13655->13654 13657 52421e _unexpected 12 API calls 13655->13657 13658 522b18 13657->13658 13659 522b20 13658->13659 13660 522b31 13658->13660 13662 5225df _unexpected 6 API calls 13659->13662 13661 5225df _unexpected 6 API calls 13660->13661 13664 522b3d 13661->13664 13663 522b2e 13662->13663 13668 5239bb __freea 12 API calls 13663->13668 13665 522b41 13664->13665 13666 522b58 13664->13666 13667 5225df _unexpected 6 API calls 13665->13667 13669 522c8c _unexpected 12 API calls 13666->13669 13667->13663 13668->13654 13670 522b63 13669->13670 13671 5239bb __freea 12 API calls 13670->13671 13671->13654 13673 522dfe ___scrt_is_nonwritable_in_current_image 13672->13673 13686 51fe41 EnterCriticalSection 13673->13686 13675 522e08 13687 522e38 13675->13687 13678 522e44 13679 522e50 ___scrt_is_nonwritable_in_current_image 13678->13679 13691 51fe41 EnterCriticalSection 13679->13691 13681 522e5a 13692 522c41 13681->13692 13683 522e72 13696 522e92 13683->13696 13686->13675 13690 51fe58 LeaveCriticalSection 13687->13690 13689 522cfa 13689->13678 13690->13689 13691->13681 13693 522c50 _unexpected 13692->13693 13695 522c77 _unexpected 13692->13695 13693->13695 13699 525b4b 13693->13699 13695->13683 13727 51fe58 LeaveCriticalSection 13696->13727 13698 522c06 13698->13602 13701 525bcb 13699->13701 13702 525b61 13699->13702 13700 525ce5 _unexpected 14 API calls 13724 525c27 13700->13724 13703 5239bb __freea 14 API calls 13701->13703 13725 525c19 13701->13725 13702->13701 13705 525b94 13702->13705 13709 5239bb __freea 14 API calls 13702->13709 13704 525bed 13703->13704 13707 5239bb __freea 14 API calls 13704->13707 13706 525bb6 13705->13706 13714 5239bb __freea 14 API calls 13705->13714 13708 5239bb __freea 14 API calls 13706->13708 13710 525c00 13707->13710 13711 525bc0 13708->13711 13713 525b89 13709->13713 13715 5239bb __freea 14 API calls 13710->13715 13716 5239bb __freea 14 API calls 13711->13716 13712 525c87 13717 5239bb __freea 14 API calls 13712->13717 13718 5255c0 ___free_lconv_mon 14 API calls 13713->13718 13719 525bab 13714->13719 13720 525c0e 13715->13720 13716->13701 13723 525c8d 13717->13723 13718->13705 13721 5256be _unexpected 14 API calls 13719->13721 13722 5239bb __freea 14 API calls 13720->13722 13721->13706 13722->13725 13723->13695 13724->13712 13726 5239bb 14 API calls __freea 13724->13726 13725->13700 13726->13724 13727->13698 13729 51fbb6 __fread_nolock CallUnexpected 13728->13729 13730 51fbe2 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 13729->13730 13733 51fcb3 CallUnexpected 13730->13733 13731 51a3d3 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 13732 51fb87 GetCurrentProcess TerminateProcess 13731->13732 13732->13556 13733->13731 13734->13524 16645 523592 16648 51fe58 LeaveCriticalSection 16645->16648 16647 523599 16648->16647 15446 5391b4 15453 5391ea 15446->15453 15447 539337 GetPEB 15448 539349 CreateProcessW VirtualAlloc Wow64GetThreadContext ReadProcessMemory VirtualAllocEx 15447->15448 15449 5393f0 WriteProcessMemory 15448->15449 15448->15453 15450 539435 15449->15450 15451 539477 WriteProcessMemory Wow64SetThreadContext ResumeThread 15450->15451 15452 53943a WriteProcessMemory 15450->15452 15452->15450 15453->15447 15453->15448 16310 522c20 16311 522c2b 16310->16311 16312 522c3b 16310->16312 16316 522d25 16311->16316 16315 5239bb __freea 14 API calls 16315->16312 16317 522d40 16316->16317 16318 522d3a 16316->16318 16320 5239bb __freea 14 API calls 16317->16320 16319 5239bb __freea 14 API calls 16318->16319 16319->16317 16321 522d4c 16320->16321 16322 5239bb __freea 14 API calls 16321->16322 16323 522d57 16322->16323 16324 5239bb __freea 14 API calls 16323->16324 16325 522d62 16324->16325 16326 5239bb __freea 14 API calls 16325->16326 16327 522d6d 16326->16327 16328 5239bb __freea 14 API calls 16327->16328 16329 522d78 16328->16329 16330 5239bb __freea 14 API calls 16329->16330 16331 522d83 16330->16331 16332 5239bb __freea 14 API calls 16331->16332 16333 522d8e 16332->16333 16334 5239bb __freea 14 API calls 16333->16334 16335 522d99 16334->16335 16336 5239bb __freea 14 API calls 16335->16336 16337 522da7 16336->16337 16342 522e9e 16337->16342 16343 522eaa ___scrt_is_nonwritable_in_current_image 16342->16343 16358 51fe41 EnterCriticalSection 16343->16358 16345 522ede 16359 522efd 16345->16359 16348 522eb4 16348->16345 16349 5239bb __freea 14 API calls 16348->16349 16349->16345 16350 522f09 16351 522f15 ___scrt_is_nonwritable_in_current_image 16350->16351 16363 51fe41 EnterCriticalSection 16351->16363 16353 522f1f 16354 522c41 _unexpected 14 API calls 16353->16354 16355 522f32 16354->16355 16364 522f52 16355->16364 16358->16348 16362 51fe58 LeaveCriticalSection 16359->16362 16361 522dcd 16361->16350 16362->16361 16363->16353 16367 51fe58 LeaveCriticalSection 16364->16367 16366 522c33 16366->16315 16367->16366

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 005391B4 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295threadinjectionmemoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00539126,00539116), ref: 0053934A
                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0053935D
                                                                                                                                                        • Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 0053937B
                                                                                                                                                        • ReadProcessMemory.KERNELBASE(0000008C,?,0053916A,00000004,00000000), ref: 0053939F
                                                                                                                                                        • VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 005393CA
                                                                                                                                                        • WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 00539422
                                                                                                                                                        • WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 0053946D
                                                                                                                                                        • WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 005394AB
                                                                                                                                                        • Wow64SetThreadContext.KERNEL32(00000094,025E0000), ref: 005394E7
                                                                                                                                                        • ResumeThread.KERNELBASE(00000094), ref: 005394F6
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
                                                                                                                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
                                                                                                                                                        • API String ID: 2687962208-3857624555
                                                                                                                                                        • Opcode ID: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
                                                                                                                                                        • Instruction ID: 6e1c79bffeaa12cf9c159a5a1db057f14428f2d64309d7e2a1684b86d1c08551
                                                                                                                                                        • Opcode Fuzzy Hash: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
                                                                                                                                                        • Instruction Fuzzy Hash: E4B1F87660068AAFDB60CF68CC80BDAB7A5FF88714F158514EA0CAB341D774FA51CB94
                                                                                                                                                        Function 004F8050 Relevance: 8.4, APIs: 2, Strings: 1, Instructions: 3159COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 203 4f8050-4f80be call 4fb600 206 4f80c0-4f80c6 203->206 207 4f80fb-4f8118 call 5202dd 206->207 208 4f80c8-4f80ce 206->208 214 4f811a 207->214 215 4f8138-4f813e 207->215 210 4f80e8-4f80f9 208->210 211 4f80d0-4f80d6 208->211 210->207 210->208 211->206 213 4f80d8-4f80e4 211->213 213->208 216 4f80e6 213->216 217 4f8190-4f8196 214->217 218 4f8144-4f814a 215->218 219 4f81e0-4f81e6 215->219 216->207 224 4f819c-4f81a2 217->224 225 4f88b0-4f88b6 217->225 222 4f8902-4f8908 218->222 223 4f8150-4f8156 218->223 220 4f8cac-4f8cb2 219->220 221 4f81ec-4f81f2 219->221 232 4f8cb8-4f8cbe 220->232 233 4fa580-4fa5a8 call 521090 220->233 230 4f81f8-4f81fe 221->230 231 4fa043-4fa46b 221->231 226 4f890e-4f8914 222->226 227 4fa48c-4fa4a3 222->227 236 4f815c-4f8162 223->236 237 4f9184-4f91df call 520707 call 520a2a call 520188 223->237 228 4f893d-4f8943 224->228 229 4f81a8-4f81ae 224->229 234 4f88bc-4f88c2 225->234 235 4f9132-4f9138 225->235 238 4f891a-4f8932 226->238 239 4f8130-4f8136 226->239 227->215 254 4fa4a9 227->254 242 4fa4ae-4fa4ff call 520707 call 520a2a call 520188 228->242 243 4f8949-4f894f 228->243 240 4f99a9-4f99c1 229->240 241 4f81b4-4f81ba 229->241 230->239 244 4f8204-4f88a4 230->244 231->215 249 4fa471 231->249 232->239 246 4f8cc4-4f9127 232->246 270 4fa5ac-4fa5b6 233->270 247 4f88c8-4f88ce 234->247 248 4fa476-4fa487 234->248 250 4f913e-4f9144 235->250 251 4fa5c1-4fa5ec 235->251 252 4f811c-4f8129 236->252 253 4f8164-4f816a 236->253 292 4f91e0-4f91e6 237->292 238->215 262 4f8938 238->262 239->215 239->217 240->215 264 4f99c7 240->264 258 4f99cc-4fa02c 241->258 259 4f81c0-4f81c6 241->259 294 4fa500-4fa506 242->294 243->239 263 4f8955-4f8ca7 243->263 260 4fa02f-4fa038 244->260 246->215 266 4f912d 246->266 247->239 261 4f88d4-4f88dc call 4f7d70 247->261 248->270 249->217 250->239 267 4f914a-4f9179 250->267 251->215 268 4fa5f2 251->268 252->239 253->239 269 4f816c-4f817f 253->269 254->217 258->260 259->239 273 4f81cc-4fa61d call 4f5170 call 51a3d3 259->273 260->215 275 4fa03e 260->275 282 4f88e1-4f88f7 261->282 262->217 263->260 264->217 266->217 267->215 277 4f917f 267->277 268->217 269->215 278 4f8181-4f818e 269->278 270->215 276 4fa5bc 270->276 275->217 277->217 278->217 282->215 285 4f88fd 282->285 285->217 295 4f921b-4f9249 call 5202dd call 52107f call 5204f6 call 520188 292->295 296 4f91e8-4f91ee 292->296 297 4fa53b-4fa575 call 5202dd call 52107f call 5204f6 call 520188 294->297 298 4fa508-4fa50e 294->298 321 4f924e-4f999e 295->321 299 4f9208-4f9219 296->299 300 4f91f0-4f91f6 296->300 297->215 324 4fa57b 297->324 302 4fa528-4fa539 298->302 303 4fa510-4fa516 298->303 299->295 299->296 300->292 304 4f91f8-4f9204 300->304 302->297 302->298 303->294 307 4fa518-4fa524 303->307 304->296 308 4f9206 304->308 307->298 311 4fa526 307->311 308->295 311->297 321->215 323 4f99a4 321->323 323->217 324->217
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: .back
                                                                                                                                                        • API String ID: 0-4099504211
                                                                                                                                                        • Opcode ID: 8fe4f789d202538dae6faa40b53fef3e2e01cf740c04dd66ad2db92356e62d1f
                                                                                                                                                        • Instruction ID: dbea1d1d589874b3c5aca9598377c50003eac5e7ca542bb53144df358644751c
                                                                                                                                                        • Opcode Fuzzy Hash: 8fe4f789d202538dae6faa40b53fef3e2e01cf740c04dd66ad2db92356e62d1f
                                                                                                                                                        • Instruction Fuzzy Hash: 4F134A7BBA16100BEB48C87A8CE63E757C357E5314F1EE43E5949C7391DCAF884A4A84
                                                                                                                                                        Function 004F7D70 Relevance: 3.2, APIs: 2, Instructions: 178memoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 508 4f7d70-4f7e2a GetPEB call 4f4ee0 FreeConsole call 4e1000 * 2 515 4f7e30-4f7e35 508->515 516 4f7e37-4f7e3c 515->516 517 4f7e60-4f7e65 515->517 520 4f7e3e-4f7e43 516->520 521 4f7eb0-4f7eb5 516->521 518 4f7e6b-4f7e70 517->518 519 4f7ef9-4f7f15 517->519 524 4f7f59-4f7f6f 518->524 525 4f7e76-4f7e7b 518->525 528 4f7f1a-4f7f1d 519->528 522 4f7edd-4f7eee 520->522 523 4f7e49-4f7e4e 520->523 526 4f7fdd-4f7ffd call 4f4ee0 521->526 527 4f7ebb-4f7ec0 521->527 522->516 533 4f7ef4 522->533 523->515 529 4f7e50-4f804a call 51a3d3 523->529 530 4f7f70-4f7f76 524->530 525->515 531 4f7e7d-4f7ea2 VirtualProtect 525->531 526->516 542 4f8003 526->542 527->515 532 4f7ec6-4f7ed5 527->532 528->528 535 4f7f1f-4f7f3d 528->535 537 4f7f78-4f7f7e 530->537 538 4f7f90-4f7f96 530->538 531->516 539 4f7ea4 531->539 532->516 540 4f7edb 532->540 533->517 543 4f7fb1-4f7fc8 537->543 544 4f7f80-4f7f86 537->544 546 4f7fcc-4f7fd9 538->546 547 4f7f98-4f7f9e 538->547 539->517 540->517 542->517 543->537 551 4f7fca 543->551 544->530 548 4f7f88-4f8023 544->548 546->537 552 4f7fdb 546->552 547->530 550 4f7fa0-4f7fad 547->550 548->516 555 4f8029 548->555 550->537 554 4f7faf 550->554 551->538 552->538 554->538 555->517
                                                                                                                                                        APIs
                                                                                                                                                        • FreeConsole.KERNELBASE ref: 004F7DEE
                                                                                                                                                        • VirtualProtect.KERNELBASE(00539027,00000000,00000040,?), ref: 004F7E8C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ConsoleFreeProtectVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 621788221-0
                                                                                                                                                        • Opcode ID: 83da22552a773bf0c4d1d86fd19f61376eed1989b8d7d836cce0c4659d20cc18
                                                                                                                                                        • Instruction ID: 9831c7d92f2fb466c58d84584699d493889a4c6a12699a5d343f447f4841bde6
                                                                                                                                                        • Opcode Fuzzy Hash: 83da22552a773bf0c4d1d86fd19f61376eed1989b8d7d836cce0c4659d20cc18
                                                                                                                                                        • Instruction Fuzzy Hash: 7161C57491921C9BCB14CB58C884ABEBBB1FF08304F14456BF649EB351D73C9C458B9A
                                                                                                                                                        Function 0052CFD7 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0052D3DC: CreateFileW.KERNELBASE(00000000,00000000,?,0052D080,?,?,00000000,?,0052D080,00000000,0000000C), ref: 0052D3F9
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0052D0EB
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D0F2
                                                                                                                                                        • GetFileType.KERNELBASE(00000000), ref: 0052D0FE
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0052D108
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D111
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0052D131
                                                                                                                                                        • CloseHandle.KERNEL32(00527C1E), ref: 0052D27E
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0052D2B0
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D2B7
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4237864984-0
                                                                                                                                                        • Opcode ID: a1a02a2f5dc91bacfa8a434b814d76f8a0ac1a839393f69598a0739bdc03365f
                                                                                                                                                        • Instruction ID: 95801759757d2290a807a9987b3ee1569e1fa2a2aef47a57c129e08d714b50ff
                                                                                                                                                        • Opcode Fuzzy Hash: a1a02a2f5dc91bacfa8a434b814d76f8a0ac1a839393f69598a0739bdc03365f
                                                                                                                                                        • Instruction Fuzzy Hash: 37A13132A141699FCF199F68EC96BAE3FB1BF4B310F140149E8019B3E1DB359816DB61
                                                                                                                                                        Function 005281FD Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 95 5281fd-52820d 96 528227-528229 95->96 97 52820f-528222 call 524181 call 52416e 95->97 99 528569-528576 call 524181 call 52416e 96->99 100 52822f-528235 96->100 114 528581 97->114 119 52857c call 51fb39 99->119 100->99 103 52823b-528264 100->103 103->99 106 52826a-528273 103->106 109 528275-528288 call 524181 call 52416e 106->109 110 52828d-52828f 106->110 109->119 112 528565-528567 110->112 113 528295-528299 110->113 116 528584-528587 112->116 113->112 118 52829f-5282a3 113->118 114->116 118->109 121 5282a5-5282bc 118->121 119->114 124 5282f1-5282f7 121->124 125 5282be-5282c1 121->125 126 5282cb-5282e2 call 524181 call 52416e call 51fb39 124->126 127 5282f9-528300 124->127 128 5282c3-5282c9 125->128 129 5282e7-5282ef 125->129 158 52849c 126->158 131 528302 127->131 132 528304-528322 call 524366 call 5239bb * 2 127->132 128->126 128->129 130 528364-528383 129->130 134 528389-528395 130->134 135 52843f-528448 call 52a164 130->135 131->132 168 528324-52833a call 52416e call 524181 132->168 169 52833f-528362 call 528c3e 132->169 134->135 138 52839b-52839d 134->138 146 52844a-52845c 135->146 147 5284b9 135->147 138->135 143 5283a3-5283c4 138->143 143->135 148 5283c6-5283dc 143->148 146->147 152 52845e-52846d GetConsoleMode 146->152 155 5284bd-5284d3 ReadFile 147->155 148->135 153 5283de-5283e0 148->153 152->147 159 52846f-528473 152->159 153->135 160 5283e2-528405 153->160 156 528531-52853c GetLastError 155->156 157 5284d5-5284db 155->157 162 528555-528558 156->162 163 52853e-528550 call 52416e call 524181 156->163 157->156 164 5284dd 157->164 166 52849f-5284a9 call 5239bb 158->166 159->155 165 528475-52848d ReadConsoleW 159->165 160->135 167 528407-52841d 160->167 175 528495-52849b call 524194 162->175 176 52855e-528560 162->176 163->158 171 5284e0-5284f2 164->171 173 5284ae-5284b7 165->173 174 52848f GetLastError 165->174 166->116 167->135 178 52841f-528421 167->178 168->158 169->130 171->166 181 5284f4-5284f8 171->181 173->171 174->175 175->158 176->166 178->135 185 528423-52843a 178->185 188 528511-52851e 181->188 189 5284fa-52850a call 528606 181->189 185->135 195 528520 call 528588 188->195 196 52852a-52852f call 5288aa 188->196 200 52850d-52850f 189->200 201 528525-528528 195->201 196->201 200->166 201->200
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 4a23f90ab2ca136bb85f4301994ee6345dd8f75979a585a04521656580ab9aba
                                                                                                                                                        • Instruction ID: 6729bfd62ed46d668473b12012ff0d415f68a076f7a87d5c3367335241e7f314
                                                                                                                                                        • Opcode Fuzzy Hash: 4a23f90ab2ca136bb85f4301994ee6345dd8f75979a585a04521656580ab9aba
                                                                                                                                                        • Instruction Fuzzy Hash: 9DB1D0B0A0526AAFDB11DFE8E884BBE7FB5BF96354F144158E500972C2CB709941CB90
                                                                                                                                                        Function 0052933D Relevance: 4.7, APIs: 3, Instructions: 197COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 325 52933d-529356 326 529358-529368 call 52d984 325->326 327 52936c-529371 325->327 326->327 333 52936a 326->333 329 529373-52937b 327->329 330 52937e-5293a4 call 52598b 327->330 329->330 335 52951a-52952b call 51a3d3 330->335 336 5293aa-5293b5 330->336 333->327 338 5293bb-5293c0 336->338 339 52950d 336->339 341 5293c2-5293cb call 52c280 338->341 342 5293d9-5293e4 call 524366 338->342 343 52950f 339->343 341->343 352 5293d1-5293d7 341->352 342->343 351 5293ea 342->351 346 529511-529518 call 52586a 343->346 346->335 353 5293f0-5293f5 351->353 352->353 353->343 354 5293fb-529410 call 52598b 353->354 354->343 357 529416-529428 call 52266c 354->357 359 52942d-529431 357->359 359->343 360 529437-52943f 359->360 361 529441-529446 360->361 362 529479-529485 360->362 361->346 365 52944c-52944e 361->365 363 529502 362->363 364 529487-529489 362->364 368 529504-52950b call 52586a 363->368 366 52948b-529494 call 52c280 364->366 367 52949e-5294a9 call 524366 364->367 365->343 369 529454-52946e call 52266c 365->369 366->368 379 529496-52949c 366->379 367->368 380 5294ab 367->380 368->343 369->346 378 529474 369->378 378->343 381 5294b1-5294b6 379->381 380->381 381->368 382 5294b8-5294d0 call 52266c 381->382 382->368 385 5294d2-5294d9 382->385 386 5294fa-529500 385->386 387 5294db-5294dc 385->387 388 5294dd-5294ef call 526daf 386->388 387->388 388->368 391 5294f1-5294f8 call 52586a 388->391 391->346
                                                                                                                                                        APIs
                                                                                                                                                        • __freea.LIBCMT ref: 005294F2
                                                                                                                                                          • Part of subcall function 00524366: RtlAllocateHeap.NTDLL(00000000,00523607,000328EC,?,00523607,00000220,?,0051FB58,000328EC), ref: 00524398
                                                                                                                                                        • __freea.LIBCMT ref: 00529505
                                                                                                                                                        • __freea.LIBCMT ref: 00529512
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __freea$AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2243444508-0
                                                                                                                                                        • Opcode ID: 56a9c5e6e239aa301109cd67f31d2ef4e39fd1f10070e628d7de047de014770d
                                                                                                                                                        • Instruction ID: 137d786cc26f09616f0dd22b15a2419200f2a38c251ba180a3dd85fe03650f8b
                                                                                                                                                        • Opcode Fuzzy Hash: 56a9c5e6e239aa301109cd67f31d2ef4e39fd1f10070e628d7de047de014770d
                                                                                                                                                        • Instruction Fuzzy Hash: FB51A372700226ABEF219F61EC85EBB7EA9FF86710F150529FD04D6291EB74DC508660
                                                                                                                                                        Function 00529695 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 451 529695-5296b7 452 5298aa 451->452 453 5296bd-5296bf 451->453 456 5298ac-5298b0 452->456 454 5296c1-5296e0 call 51fce2 453->454 455 5296eb-52970e 453->455 462 5296e3-5296e6 454->462 458 529710-529712 455->458 459 529714-52971a 455->459 458->459 461 52971c-52972d 458->461 459->454 459->461 463 529740-529750 call 5299c2 461->463 464 52972f-52973d call 528c7e 461->464 462->456 469 529752-529758 463->469 470 529799-5297ab 463->470 464->463 471 529781-529797 call 529a3f 469->471 472 52975a-52975d 469->472 473 529802-529822 WriteFile 470->473 474 5297ad-5297b3 470->474 494 52977a-52977c 471->494 475 529768-529777 call 529e06 472->475 476 52975f-529762 472->476 478 529824-52982a GetLastError 473->478 479 52982d 473->479 480 5297b5-5297b8 474->480 481 5297ee-5297fb call 529e6e 474->481 475->494 476->475 484 529842-529845 476->484 478->479 488 529830-52983b 479->488 482 5297da-5297ec call 52a032 480->482 483 5297ba-5297bd 480->483 493 529800 481->493 501 5297d5-5297d8 482->501 489 529848-52984a 483->489 490 5297c3-5297d0 call 529f49 483->490 484->489 495 5298a5-5298a8 488->495 496 52983d-529840 488->496 497 529878-529884 489->497 498 52984c-529851 489->498 490->501 493->501 494->488 495->456 496->484 504 529886-52988c 497->504 505 52988e-5298a0 497->505 502 529853-529865 498->502 503 52986a-529873 call 5241fa 498->503 501->494 502->462 503->462 504->452 504->505 505->462
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00529A3F: GetConsoleOutputCP.KERNEL32(D2AA1F0E,00000000,00000000,?), ref: 00529AA2
                                                                                                                                                        • WriteFile.KERNEL32(?,?,-00000001,?,00000000,?,00000000,?,?,?,-00000001,?,0051D3B2,?,0051D614), ref: 0052981A
                                                                                                                                                        • GetLastError.KERNEL32(?,0051D3B2,?,0051D614,?,0051D614,-00000001,?,?,00000000,?,-00000001,00000000,?,-00000001,?), ref: 00529824
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ConsoleErrorFileLastOutputWrite
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2915228174-0
                                                                                                                                                        • Opcode ID: ed207c48e95c63029f0c8be57365abcab981e4691ba93dd5182315e47b8b38fb
                                                                                                                                                        • Instruction ID: c938c18f2711ebf90d1f8151f149e8b9e96babc0019c3b9952e3b764bb6f75ab
                                                                                                                                                        • Opcode Fuzzy Hash: ed207c48e95c63029f0c8be57365abcab981e4691ba93dd5182315e47b8b38fb
                                                                                                                                                        • Instruction Fuzzy Hash: 206191B1D0412AABDF158FA8E884EEE7FB9FF5B304F180149E804A7396D331D9019B61
                                                                                                                                                        Function 0052323A Relevance: 3.2, APIs: 2, Instructions: 177COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 556 52323a-523262 call 52343f 559 523427-523428 call 5234b0 556->559 560 523268-52326e 556->560 563 52342d-52342f 559->563 561 523271-523277 560->561 564 523373-523392 call 51ca00 561->564 565 52327d-523289 561->565 566 523430-52343e call 51a3d3 563->566 575 523395-52339a 564->575 565->561 567 52328b-523291 565->567 570 523297-5232a3 IsValidCodePage 567->570 571 52336b-52336e 567->571 570->571 574 5232a9-5232b0 570->574 571->566 576 5232d2-5232df GetCPInfo 574->576 577 5232b2-5232be 574->577 578 5233d7-5233e1 575->578 579 52339c-5233a1 575->579 584 5232e1-523300 call 51ca00 576->584 585 52335f-523365 576->585 583 5232c2-5232cd 577->583 578->575 582 5233e3-52340d call 52378b 578->582 580 5233a3-5233ab 579->580 581 5233d4 579->581 586 5233cc-5233d2 580->586 587 5233ad-5233b0 580->587 581->578 596 52340e-52341d 582->596 589 52341f-523420 call 5237c9 583->589 584->583 598 523302-523309 584->598 585->559 585->571 586->579 586->581 591 5233b2-5233b8 587->591 597 523425 589->597 591->586 595 5233ba-5233ca 591->595 595->586 595->591 596->589 596->596 597->563 599 523335-523338 598->599 600 52330b-523310 598->600 602 52333d-523344 599->602 600->599 601 523312-52331a 600->601 603 52331c-523323 601->603 604 52332d-523333 601->604 602->602 605 523346-52335a call 52378b 602->605 606 523324-52332b 603->606 604->599 604->600 605->583 606->604 606->606
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0052343F: GetOEMCP.KERNEL32(00000000,?,?,0051FB58,000328EC), ref: 0052346A
                                                                                                                                                        • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0052364A,?,00000000,?,0051FB58,000328EC), ref: 0052329B
                                                                                                                                                        • GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0052364A,?,00000000,?,0051FB58,000328EC), ref: 005232D7
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CodeInfoPageValid
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 546120528-0
                                                                                                                                                        • Opcode ID: 7259ec2df75e9686c0608689a7b084576f5e407999a352f27b78f98c58b4b077
                                                                                                                                                        • Instruction ID: 2b9949aaaf2cb8d88272089d21ce56e7c2cb6ba6622136dc13830e3e5d40423c
                                                                                                                                                        • Opcode Fuzzy Hash: 7259ec2df75e9686c0608689a7b084576f5e407999a352f27b78f98c58b4b077
                                                                                                                                                        • Instruction Fuzzy Hash: 425136B1A003658EDB21DF25D4846AABFE4FFA6300F14496ED08287291DB789B46CB80
                                                                                                                                                        Function 0051A366 Relevance: 3.1, APIs: 2, Instructions: 93COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 609 51a366-51a369 610 51a378-51a37b call 52107f 609->610 612 51a380-51a383 610->612 613 51a385-51a386 612->613 614 51a36b-51a376 call 51efe1 612->614 614->610 617 51a387-51a38b 614->617 618 51a391-51ab4a call 51aa44 call 51bbec 617->618 619 51ab4b-51ab7b call 502af0 call 51bbec IsProcessorFeaturePresent 617->619 618->619 630 51ab82-51ac61 call 51ac62 619->630 631 51ab7d-51ab80 619->631 631->630
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0051AB73
                                                                                                                                                        • ___raise_securityfailure.LIBCMT ref: 0051AC5B
                                                                                                                                                          • Part of subcall function 0051BBEC: RaiseException.KERNEL32(E06D7363,00000001,00000003,A9EC08B0,953CB534,00000000,?,0051AA7B,A9EC08B0,0053879C,?,A9EC08B0,?,?), ref: 0051BC4C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3749517692-0
                                                                                                                                                        • Opcode ID: 3418a0cc420e4874651e214a5acddff3e8d187fb3517d28a95f6712db983cb1a
                                                                                                                                                        • Instruction ID: 29d2bb57978dbffb49cf43bdda51d8bbd8b70d9ec7513a066cda33198d7fb71e
                                                                                                                                                        • Opcode Fuzzy Hash: 3418a0cc420e4874651e214a5acddff3e8d187fb3517d28a95f6712db983cb1a
                                                                                                                                                        • Instruction Fuzzy Hash: D4318DB49053059BEB01DF64FC4BB843FA8BB68310F14412AF944C73B1E7B09A89DB86
                                                                                                                                                        Function 00529E6E Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 634 529e6e-529ec3 call 528f20 637 529ec5 634->637 638 529f38-529f48 call 51a3d3 634->638 640 529ecb 637->640 642 529ed1-529ed3 640->642 643 529ed5-529eda 642->643 644 529eed-529f12 WriteFile 642->644 645 529ee3-529eeb 643->645 646 529edc-529ee2 643->646 647 529f30-529f36 GetLastError 644->647 648 529f14-529f1f 644->648 645->642 645->644 646->645 647->638 648->638 649 529f21-529f2c 648->649 649->640 650 529f2e 649->650 650->638
                                                                                                                                                        APIs
                                                                                                                                                        • WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00529800,?,0051D614,?,-00000001,?,00000000), ref: 00529F0A
                                                                                                                                                        • GetLastError.KERNEL32(?,00529800,?,0051D614,?,-00000001,?,00000000,?,?,?,-00000001,?,0051D3B2,?,0051D614), ref: 00529F30
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFileLastWrite
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 442123175-0
                                                                                                                                                        • Opcode ID: 5bf175123c3c8eea7ebddfa13d7782fe787cbdc5b2869c6cae92d224b1dcb22b
                                                                                                                                                        • Instruction ID: 22c085d0abd19116144a881a7805d023aa6c66a28a3ae8b6de4f2d4ee43851f3
                                                                                                                                                        • Opcode Fuzzy Hash: 5bf175123c3c8eea7ebddfa13d7782fe787cbdc5b2869c6cae92d224b1dcb22b
                                                                                                                                                        • Instruction Fuzzy Hash: D3218235A002299BCB1ACF29DD809EDBBB9FF89305F1440A9E946D7351D6309D86CB64
                                                                                                                                                        Function 005230A2 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 651 5230a2-5230a7 652 5230a9-5230c1 651->652 653 5230c3-5230c7 652->653 654 5230cf-5230d8 652->654 653->654 655 5230c9-5230cd 653->655 656 5230ea 654->656 657 5230da-5230dd 654->657 659 523144-523148 655->659 658 5230ec-5230f9 GetStdHandle 656->658 660 5230e6-5230e8 657->660 661 5230df-5230e4 657->661 662 523126-523138 658->662 663 5230fb-5230fd 658->663 659->652 664 52314e-523151 659->664 660->658 661->658 662->659 666 52313a-52313d 662->666 663->662 665 5230ff-523108 GetFileType 663->665 665->662 667 52310a-523113 665->667 666->659 668 523115-523119 667->668 669 52311b-52311e 667->669 668->659 669->659 670 523120-523124 669->670 670->659
                                                                                                                                                        APIs
                                                                                                                                                        • GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00522F91,00538C18,0000000C), ref: 005230EE
                                                                                                                                                        • GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00522F91,00538C18,0000000C), ref: 00523100
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileHandleType
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3000768030-0
                                                                                                                                                        • Opcode ID: 3f004469b8f68d038d68a1c8d4a6e49608a9be75aa6235eba05a8e681ee188f6
                                                                                                                                                        • Instruction ID: 6c733edc3feeac882d7180c25e4cd7e4102bf6efb651862f8a00499e3eb98fbe
                                                                                                                                                        • Opcode Fuzzy Hash: 3f004469b8f68d038d68a1c8d4a6e49608a9be75aa6235eba05a8e681ee188f6
                                                                                                                                                        • Instruction Fuzzy Hash: 511196716087714AC7304E3EAC8C522BE95BF57330B380B19D1B6876F1C739DA5AD251
                                                                                                                                                        Function 00528DDF Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 671 528ddf-528df7 call 52730c 674 528df9-528e00 671->674 675 528e0d-528e23 SetFilePointerEx 671->675 676 528e07-528e0b 674->676 677 528e25-528e36 GetLastError call 5241fa 675->677 678 528e38-528e42 675->678 679 528e5e-528e61 676->679 677->676 678->676 681 528e44-528e59 678->681 681->679
                                                                                                                                                        APIs
                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000002,?,00000000,?,?,?,00528C97,00000000,?,?,00000002,00000000), ref: 00528E1B
                                                                                                                                                        • GetLastError.KERNEL32(00000000,?,00528C97,00000000,?,?,00000002,00000000,?,0052973A,?,00000000,00000000,00000002,?,?), ref: 00528E28
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                        • Opcode ID: c25d66be026c64e0638f771964319a7fba2b50c02ed199b32365d4d89f5ec3a6
                                                                                                                                                        • Instruction ID: 810db54fd94e6cac063eef3a6d4f1fd17765121cef310eaf4c4787c6c69e7760
                                                                                                                                                        • Opcode Fuzzy Hash: c25d66be026c64e0638f771964319a7fba2b50c02ed199b32365d4d89f5ec3a6
                                                                                                                                                        • Instruction Fuzzy Hash: 43012B32604169AFCB058F59EC05CAE3F2DFF96374B250548F811972D0EA71ED41DB90
                                                                                                                                                        Function 0052266C Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 683 52266c-52267b call 5228be 686 5226a4-5226be call 5226c9 LCMapStringW 683->686 687 52267d-5226a2 LCMapStringEx 683->687 691 5226c4-5226c6 686->691 687->691
                                                                                                                                                        APIs
                                                                                                                                                        • LCMapStringEx.KERNELBASE(?,0052942D,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 005226A0
                                                                                                                                                        • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,0052942D,?,?,-00000008,?,00000000), ref: 005226BE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: String
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2568140703-0
                                                                                                                                                        • Opcode ID: 1966d97596d58c168d814c655bd56b697501d8bb31d6a7e64b4004eeb9daf684
                                                                                                                                                        • Instruction ID: 58ac225a43df8a98f3268efee9806cace7466f02598dd01aeb595c1deb754ac4
                                                                                                                                                        • Opcode Fuzzy Hash: 1966d97596d58c168d814c655bd56b697501d8bb31d6a7e64b4004eeb9daf684
                                                                                                                                                        • Instruction Fuzzy Hash: 39F0683740012ABBCF126F90EC09ADE3E26BF59364F054010FA1865160CB32D871AB94
                                                                                                                                                        Function 00527786 Relevance: 2.6, APIs: 2, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 692 527786-52779a call 52730c 695 5277a0-5277a8 692->695 696 52779c-52779e 692->696 698 5277b3-5277b6 695->698 699 5277aa-5277b1 695->699 697 5277ee-52780e call 527489 696->697 708 527820 697->708 709 527810-52781e call 5241fa 697->709 702 5277d4-5277e4 call 52730c CloseHandle 698->702 703 5277b8-5277bc 698->703 699->698 701 5277be-5277d2 call 52730c * 2 699->701 701->696 701->702 702->696 711 5277e6-5277ec GetLastError 702->711 703->701 703->702 713 527822-527825 708->713 709->713 711->697
                                                                                                                                                        APIs
                                                                                                                                                        • CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,00527914,00000000,CF830579,00538D78,0000000C,0052789C,0052021B,?), ref: 005277DC
                                                                                                                                                        • GetLastError.KERNEL32(?,00527914,00000000,CF830579,00538D78,0000000C,0052789C,0052021B,?), ref: 005277E6
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                                        • Opcode ID: 9b96931cb07091e4035c6aabcdaf6945f9bba1728ea23db567e5f6577d4eb43d
                                                                                                                                                        • Instruction ID: 9471ba5d7b8c2e00d08b8c9ade0962ef7764f7600fcbc4cd747cee94ed9a29cd
                                                                                                                                                        • Opcode Fuzzy Hash: 9b96931cb07091e4035c6aabcdaf6945f9bba1728ea23db567e5f6577d4eb43d
                                                                                                                                                        • Instruction Fuzzy Hash: E411253260D13C5BDA25E234BC49B7E2F49FFDF730F290659F808872D2DA608884D250
                                                                                                                                                        Function 00520E2C Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 9b5606ed2409fd25ac1c713c087e6f2c899e7aa218b84d0e2be6c4344eef9e7c
                                                                                                                                                        • Instruction ID: 0b60e95ddb7164bb9199eb76963ebddb3c093c113d1d2656372153c60b563b51
                                                                                                                                                        • Opcode Fuzzy Hash: 9b5606ed2409fd25ac1c713c087e6f2c899e7aa218b84d0e2be6c4344eef9e7c
                                                                                                                                                        • Instruction Fuzzy Hash: E051D171A41214AFDB24CF58D985AA97FB1FF8A364F259158F8085B2E3D3319E81CB90
                                                                                                                                                        Function 005237C9 Relevance: 1.6, APIs: 1, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCPInfo.KERNEL32(00000083,?,00000005,0052364A,?), ref: 005237FB
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Info
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1807457897-0
                                                                                                                                                        • Opcode ID: d7ec5a4fc2fca019675b9d291d195e6fb90837752b12d871dd2060cbbff51b07
                                                                                                                                                        • Instruction ID: 5d7844a813e68d0ca52b31cf02437f0e1a845b906bc4e150d81784b49272640c
                                                                                                                                                        • Opcode Fuzzy Hash: d7ec5a4fc2fca019675b9d291d195e6fb90837752b12d871dd2060cbbff51b07
                                                                                                                                                        • Instruction Fuzzy Hash: C6514BB1905168AADB118E28DC84BE97F6CFF17300F1401E9E199CB1C2D3799E89DF60
                                                                                                                                                        Function 00527AC0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __wsopen_s
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3347428461-0
                                                                                                                                                        • Opcode ID: 794ed4fb83382f2caa5c5003d66e2604355a1a64bc601c77638f900d1d38223e
                                                                                                                                                        • Instruction ID: 94fdb4eccc240c1c4488b26c11bae3f69abb79bc96be1f763f32b37fd731d6ef
                                                                                                                                                        • Opcode Fuzzy Hash: 794ed4fb83382f2caa5c5003d66e2604355a1a64bc601c77638f900d1d38223e
                                                                                                                                                        • Instruction Fuzzy Hash: 2C118C71A0420EAFCB05DF58E94599B7BF9FF89304F104099F809AB341D631EE11CBA5
                                                                                                                                                        Function 004F7F3E Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • VirtualProtect.KERNELBASE(00539027,00000000,00000040,?), ref: 004F7E8C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ProtectVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 544645111-0
                                                                                                                                                        • Opcode ID: dcc4bc658faf1866e06b64761c322056fda53f4afa2c047e6c27165fe698010b
                                                                                                                                                        • Instruction ID: b8a1db82ffda8f85620168b5cea4b31d176e6f353cf9b2e3210e190e465e7cd0
                                                                                                                                                        • Opcode Fuzzy Hash: dcc4bc658faf1866e06b64761c322056fda53f4afa2c047e6c27165fe698010b
                                                                                                                                                        • Instruction Fuzzy Hash: 5A012B35A0810D9BDF248598E8D55BEB7A1AB08310B240457FB46EB300D61CDC85879F
                                                                                                                                                        Function 0052421E Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,00522BBF,00000001,00000364,00000002,000000FF,?,00000000,?,0051D1D5,00000000,1711FF87), ref: 0052425F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: e0cc04b98390977042c0b986ebd9d6bd86a1c50978735f3c34271a9e9241c21a
                                                                                                                                                        • Instruction ID: f03c8f98d582541ec17d5469a0b3b1b1b629f24ca5aa724472ab1353f0fd53d9
                                                                                                                                                        • Opcode Fuzzy Hash: e0cc04b98390977042c0b986ebd9d6bd86a1c50978735f3c34271a9e9241c21a
                                                                                                                                                        • Instruction Fuzzy Hash: F4F0B439608635E79B215B23BC05A6B3F49BFD3760F158111BC14961C4CA20D8019EA0
                                                                                                                                                        Function 00524366 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,00523607,000328EC,?,00523607,00000220,?,0051FB58,000328EC), ref: 00524398
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: 59fbcb7b41fad3648ed2950242ef8ea661ede4371e24d1a196d6cfed9a19cd2b
                                                                                                                                                        • Instruction ID: 3bab71cacd4a88c2207029966075f6c7e92554fbc403c47a02958d9cc6b942cd
                                                                                                                                                        • Opcode Fuzzy Hash: 59fbcb7b41fad3648ed2950242ef8ea661ede4371e24d1a196d6cfed9a19cd2b
                                                                                                                                                        • Instruction Fuzzy Hash: 3FE06D211452759BEB22A666FC09BAB7E8CBFB37B0F150920BC45961D1DB20DC81D9A1
                                                                                                                                                        Function 0052D3DC Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,00000000,?,0052D080,?,?,00000000,?,0052D080,00000000,0000000C), ref: 0052D3F9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateFile
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 823142352-0
                                                                                                                                                        • Opcode ID: c5554321f0f10b17c4e20f8efa256812dee5f4b49533b5f36cf15aa3cd07a85b
                                                                                                                                                        • Instruction ID: 7677012b672189cb0b3e4b839779e99980a835495482934d6f83ba68696ac2fa
                                                                                                                                                        • Opcode Fuzzy Hash: c5554321f0f10b17c4e20f8efa256812dee5f4b49533b5f36cf15aa3cd07a85b
                                                                                                                                                        • Instruction Fuzzy Hash: 12D06C3200010DBBDF128F84DC06EDA3FAAFB4C714F018000BA1856120C732E821EB90

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 0051AD82 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0051AD96
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0051ADA4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0051ADB5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0051ADC6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0051ADD7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0051ADE8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0051ADF9
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0051AE0A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0051AE1B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0051AE2C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0051AE3D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0051AE4E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0051AE5F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0051AE70
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0051AE81
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0051AE92
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0051AEA3
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0051AEB4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0051AEC5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0051AED6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0051AEE7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0051AEF8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0051AF09
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0051AF1A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0051AF2B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0051AF3C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0051AF4D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0051AF5E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0051AF6F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0051AF80
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0051AF91
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0051AFA2
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0051AFB3
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0051AFC4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0051AFD5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0051AFE6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0051AFF7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0051B008
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0051B019
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0051B02A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0051B03B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                        • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                                                                                        • API String ID: 667068680-295688737
                                                                                                                                                        • Opcode ID: 3f4110005ec394cecff0116888c9302d0070edc1edc0c67fac52fd52359f8e92
                                                                                                                                                        • Instruction ID: 09bf8c714df9f498236de3ac7a1366a4f470d9f98e3a90b7fa6d837dc0a394d7
                                                                                                                                                        • Opcode Fuzzy Hash: 3f4110005ec394cecff0116888c9302d0070edc1edc0c67fac52fd52359f8e92
                                                                                                                                                        • Instruction Fuzzy Hash: EC61AAB2D56B14BBCB119FB4AE4D85A3FA8FA3D7027001456B142E2762E7B44088FF91
                                                                                                                                                        Function 00507420 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 281COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::_Xinvalid_argument.LIBCPMT ref: 0050772C
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Xinvalid_argumentstd::_
                                                                                                                                                        • String ID: vector too long$xu%|$xu%|$xu%|
                                                                                                                                                        • API String ID: 909987262-2952769458
                                                                                                                                                        • Opcode ID: 07b6b37315ec8c9c0dc43ec2e9b273b2d1b6f523e3d0c35cc9b34291fee86374
                                                                                                                                                        • Instruction ID: a86e84b3caeeeb8b54e5f6be3b8719197a9be13443865b36d0e1259bcd52ad23
                                                                                                                                                        • Opcode Fuzzy Hash: 07b6b37315ec8c9c0dc43ec2e9b273b2d1b6f523e3d0c35cc9b34291fee86374
                                                                                                                                                        • Instruction Fuzzy Hash: 3671473BFA55100BEB1888798C9A3D767C347D5314F1BE43A4989D7281ECAF5C4A5B80
                                                                                                                                                        Function 0052BA90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: eb53c55c443de7508ee645b653adc9b5bf38fd51a121fd7e01578c595efa0f76
                                                                                                                                                        • Instruction ID: 0ab3516b638c39718b580db9c8ec25413d311520ff6ad09ae65e8f812d99a872
                                                                                                                                                        • Opcode Fuzzy Hash: eb53c55c443de7508ee645b653adc9b5bf38fd51a121fd7e01578c595efa0f76
                                                                                                                                                        • Instruction Fuzzy Hash: 5E025C71E002299BEF14CFA8D8807EEBBB5FF49314F258269E515A7381D731AE41CB80
                                                                                                                                                        Function 00526378 Relevance: 6.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00526468
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                        • Opcode ID: 5fa66669e9684112d3f38ee6a75e977b217276935ea74b68e9b037c3eef6ea4c
                                                                                                                                                        • Instruction ID: 6e608dec6f40ee5e6c41c36b0330c1c5f11ce6533ed82073435364c406d004a1
                                                                                                                                                        • Opcode Fuzzy Hash: 5fa66669e9684112d3f38ee6a75e977b217276935ea74b68e9b037c3eef6ea4c
                                                                                                                                                        • Instruction Fuzzy Hash: A971F2B19051799FDF20EF24AC9DAAEBFB9BF46300F5441D9E04893291EA318E859F50
                                                                                                                                                        Function 0051B644 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0051B650
                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 0051B71C
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B73C
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0051B746
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 254469556-0
                                                                                                                                                        • Opcode ID: fd0a53087488cb679fdb108ff33b9f726fedf2d1ec94802b9519cdda0f7db4f3
                                                                                                                                                        • Instruction ID: 0c4b5d6df672580a799f27f9ec93a4a6b13282fded62735cb999c1f15967212e
                                                                                                                                                        • Opcode Fuzzy Hash: fd0a53087488cb679fdb108ff33b9f726fedf2d1ec94802b9519cdda0f7db4f3
                                                                                                                                                        • Instruction Fuzzy Hash: AB313AB5D4521D9BEB21DF64D9897CDBBB8BF08300F10419AE40DA7250EB715B889F44
                                                                                                                                                        Function 0051FB9A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0051FC92
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0051FC9C
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(0051F830,?,?,?,?,?,?), ref: 0051FCA9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3906539128-0
                                                                                                                                                        • Opcode ID: 3b0135eb38e2cff066655935f2466615837ea5ef475f55d7f8f4cee1483e6ea1
                                                                                                                                                        • Instruction ID: 5a3e86b06a8260ac97f56b4810136e5aa18aacdb30389c9bf1737a2694e348af
                                                                                                                                                        • Opcode Fuzzy Hash: 3b0135eb38e2cff066655935f2466615837ea5ef475f55d7f8f4cee1483e6ea1
                                                                                                                                                        • Instruction Fuzzy Hash: 6831C2B490121D9BDB21DF28D9887C9BBB4BF18310F5041EAE40CA6250EB709FC59F44
                                                                                                                                                        Function 005262C7 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0052421E: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,00522BBF,00000001,00000364,00000002,000000FF,?,00000000,?,0051D1D5,00000000,1711FF87), ref: 0052425F
                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00526468
                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0052655C
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 0052659B
                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 005265CE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Find$CloseFile$AllocateFirstHeapNext
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4087847297-0
                                                                                                                                                        • Opcode ID: 44ed3fef160c02d6c9d60d0d83ecc744d0ac464e8fa59c3dff042e59fd934b37
                                                                                                                                                        • Instruction ID: efcaeeb01fdc44d9ab27b7fbdaf9b04505fba76f15dcf16ffee81b8ca9ac8feb
                                                                                                                                                        • Opcode Fuzzy Hash: 44ed3fef160c02d6c9d60d0d83ecc744d0ac464e8fa59c3dff042e59fd934b37
                                                                                                                                                        • Instruction Fuzzy Hash: 98513676904139AFDF24DF28AC999BE7FA9FF87314F144499F449D3281EA308E419B60
                                                                                                                                                        Function 0051B3FD Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0051B413
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FeaturePresentProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2325560087-0
                                                                                                                                                        • Opcode ID: 89453da55c24e1a39f9ed37a729cec65014e983e3e8f7fad80ab645c1e557a71
                                                                                                                                                        • Instruction ID: 1349e69b9fb0ab88e322ee98bda822bbe4d864a57b90c7a617ef6103fe11426c
                                                                                                                                                        • Opcode Fuzzy Hash: 89453da55c24e1a39f9ed37a729cec65014e983e3e8f7fad80ab645c1e557a71
                                                                                                                                                        • Instruction Fuzzy Hash: 5851BDB1A01205CBFB15CF54D9D07EABBF6FB58310F25842AD452EB361E3B49984CB60
                                                                                                                                                        Function 0051B638 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0003B760), ref: 0051B63D
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                        • Opcode ID: 740f1d4725e995567410b32e3726c7e4b8deb3808b4507de8c9d81cab8ca90c4
                                                                                                                                                        • Instruction ID: 41db2e563c9fcdd2f58324a84e4f39cbd50355b6debb5bad2860cd26a052a54f
                                                                                                                                                        • Opcode Fuzzy Hash: 740f1d4725e995567410b32e3726c7e4b8deb3808b4507de8c9d81cab8ca90c4
                                                                                                                                                        • Instruction Fuzzy Hash:
                                                                                                                                                        Function 00522900 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: HeapProcess
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 54951025-0
                                                                                                                                                        • Opcode ID: a521bc69632e494c4037292069e7c564594d7ebfc9760824e1326db5343294a5
                                                                                                                                                        • Instruction ID: 6d75d5c567a2ff12703a6b048b4491ea045bb143d310db519e51af6d84c59987
                                                                                                                                                        • Opcode Fuzzy Hash: a521bc69632e494c4037292069e7c564594d7ebfc9760824e1326db5343294a5
                                                                                                                                                        • Instruction Fuzzy Hash: 31A022F0A002C0CF83028F32AE0C30C3BE8BA283C03088028A000C83B0EB3080C8BF02
                                                                                                                                                        Function 00521AE3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • type_info::operator==.LIBVCRUNTIME ref: 00521C02
                                                                                                                                                        • ___TypeMatch.LIBVCRUNTIME ref: 00521D10
                                                                                                                                                        • CatchIt.LIBVCRUNTIME ref: 00521D61
                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00521E62
                                                                                                                                                        • CallUnexpected.LIBVCRUNTIME ref: 00521E7D
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                        • API String ID: 4119006552-393685449
                                                                                                                                                        • Opcode ID: effc6da35d74a7d035f88943ec416ee25d28e11b1caf8c628bb656303d7db470
                                                                                                                                                        • Instruction ID: 7c8f095cb6e2ff272f3a9577f0a1106048fca3a6e5f6395305ce30490c8286ca
                                                                                                                                                        • Opcode Fuzzy Hash: effc6da35d74a7d035f88943ec416ee25d28e11b1caf8c628bb656303d7db470
                                                                                                                                                        • Instruction Fuzzy Hash: FAB1BF75800A2ADFCF18DFA4E8449AFBFB9FF66300B154459E8006B281D730DE51CB99
                                                                                                                                                        Function 00524D1B Relevance: 10.8, APIs: 7, Instructions: 329COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _strrchr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3213747228-0
                                                                                                                                                        • Opcode ID: a8e5336aae3c51094d57f33ed622fdcb4f0028160ae107eaa9530d56252e24a8
                                                                                                                                                        • Instruction ID: f99c97effe65b96dd2d0d0bf688d59971bd5363efacc6c3c50cdaa241900c6e7
                                                                                                                                                        • Opcode Fuzzy Hash: a8e5336aae3c51094d57f33ed622fdcb4f0028160ae107eaa9530d56252e24a8
                                                                                                                                                        • Instruction Fuzzy Hash: 9EB15632A00276AFEB15CF64EC85BAE7FA5FF96310F154155E904AB3C2E3749941CBA0
                                                                                                                                                        Function 0051C320 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C357
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 0051C35F
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C3E8
                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 0051C413
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C468
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                        • String ID: csm
                                                                                                                                                        • API String ID: 1170836740-1018135373
                                                                                                                                                        • Opcode ID: c9a556edd72278a5d638d7e383d0a746d974b08ff7b55325465554bb9ee3d4bc
                                                                                                                                                        • Instruction ID: 013bef958af9ab0d9f58a9458bb26756363efecf4e4039a7b96ff65987c574d7
                                                                                                                                                        • Opcode Fuzzy Hash: c9a556edd72278a5d638d7e383d0a746d974b08ff7b55325465554bb9ee3d4bc
                                                                                                                                                        • Instruction Fuzzy Hash: E1410534A00219ABCF10DF68C885ADEBFB0FF45314F14C555E824AB392D772EA85CB91
                                                                                                                                                        Function 0052273A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,00522849,00000000,3A61198B,00000000,00000000,00000000,?,005225FB,00000022,FlsSetValue,00531ED0,00531ED8,00000000), ref: 005227FB
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                                        • API String ID: 3664257935-537541572
                                                                                                                                                        • Opcode ID: e07a4b20fa52c9246089543c816b831958ffe4066ebfda0a1cac55c71587752f
                                                                                                                                                        • Instruction ID: d54299e3af2bc88d0e1994d7b2785d07253716b0d82aedfb577cdd726ccc0da0
                                                                                                                                                        • Opcode Fuzzy Hash: e07a4b20fa52c9246089543c816b831958ffe4066ebfda0a1cac55c71587752f
                                                                                                                                                        • Instruction Fuzzy Hash: CA21D57AE09225BBD7319B24BC84A6A3F58FF57760F290110F915A72D0D730ED05E6E0
                                                                                                                                                        Function 00506290 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 41COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_destroy.LIBVCRUNTIME ref: 005062AC
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_destroy
                                                                                                                                                        • String ID: ]IC9$]IC9$]IC9$]IC9$]IC9
                                                                                                                                                        • API String ID: 4194217158-2037520495
                                                                                                                                                        • Opcode ID: db58a8d35a3c46af18cefb36ee55e2c82bd8bc06ab1d5c76b790da8fc9239880
                                                                                                                                                        • Instruction ID: f8c3fd8fb5d5b70b6cbd5c29570fce2cc17f7700197f96165edb477914b72bfd
                                                                                                                                                        • Opcode Fuzzy Hash: db58a8d35a3c46af18cefb36ee55e2c82bd8bc06ab1d5c76b790da8fc9239880
                                                                                                                                                        • Instruction Fuzzy Hash: B9014EB190511287D9106B3C98852AE7FD07F25708F504D6DF495DB250E330ECA4CBC3
                                                                                                                                                        Function 0052E506 Relevance: 9.2, APIs: 6, Instructions: 248COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCPInfo.KERNEL32(02931DE8,02931DE8,00000000,7FFFFFFF,?,0052E4F1,02931DE8,02931DE8,00000000,02931DE8,?,?,?,?,02931DE8,00000000), ref: 0052E5AC
                                                                                                                                                        • __freea.LIBCMT ref: 0052E741
                                                                                                                                                        • __freea.LIBCMT ref: 0052E747
                                                                                                                                                        • __freea.LIBCMT ref: 0052E77D
                                                                                                                                                        • __freea.LIBCMT ref: 0052E783
                                                                                                                                                        • __freea.LIBCMT ref: 0052E793
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __freea$Info
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 541289543-0
                                                                                                                                                        • Opcode ID: ad36652516701d584dd5ce29175403be39c27d8f5ae5192088788222f28ebe36
                                                                                                                                                        • Instruction ID: 4c117725ad2a34dd2ef1b7786f8149111be5fb0b288df05a3b0a6dd706af482f
                                                                                                                                                        • Opcode Fuzzy Hash: ad36652516701d584dd5ce29175403be39c27d8f5ae5192088788222f28ebe36
                                                                                                                                                        • Instruction Fuzzy Hash: 4871E572A002669BDF209E64AC87BAE7FB6FF97714F2C0415E904A72C1E735AC408760
                                                                                                                                                        Function 00521243 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,0052123A,0051C0FD,0051B7A4), ref: 00521251
                                                                                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0052125F
                                                                                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00521278
                                                                                                                                                        • SetLastError.KERNEL32(00000000,0052123A,0051C0FD,0051B7A4), ref: 005212CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3852720340-0
                                                                                                                                                        • Opcode ID: 8c824e6d79ce9907703927ab0627e95ca7faef46f07764d8249e61a8b8bd3b32
                                                                                                                                                        • Instruction ID: 01d095279d621ed61b5e482c57a293b875b5f196f68026d2094913fb4aa73af5
                                                                                                                                                        • Opcode Fuzzy Hash: 8c824e6d79ce9907703927ab0627e95ca7faef46f07764d8249e61a8b8bd3b32
                                                                                                                                                        • Instruction Fuzzy Hash: 2201D87A50AA329EEA241BB97C8A56B2F95FF733743200229F510D01F1EF514C14E598
                                                                                                                                                        Function 005266F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\10000600101\c.exe, xrefs: 00526710
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\10000600101\c.exe
                                                                                                                                                        • API String ID: 0-334169947
                                                                                                                                                        • Opcode ID: a113f33ccece13937f9384f2d914ebb7694e33fecce0141fe8cda064dd60a32e
                                                                                                                                                        • Instruction ID: eed7b69d6bf31eda2eaa1404c813dd590c68b4cb6a637e71ba9507b08fc2880f
                                                                                                                                                        • Opcode Fuzzy Hash: a113f33ccece13937f9384f2d914ebb7694e33fecce0141fe8cda064dd60a32e
                                                                                                                                                        • Instruction Fuzzy Hash: F5216F7160423AAFDB20AF71FC8596B7FA9FF923687184519F815971D1DB30EC508B90
                                                                                                                                                        Function 0051ED2E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D2AA1F0E,?,?,00000000,005303E8,000000FF,?,0051EDEF,0051ECD6,?,0051EE8B,00000000), ref: 0051ED63
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0051ED75
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,00000000,005303E8,000000FF,?,0051EDEF,0051ECD6,?,0051EE8B,00000000), ref: 0051ED97
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                        • Opcode ID: facb527fe486dfc3fc3d87f2375e4c643ff25ae6e63a15fa277d8cd95c3230da
                                                                                                                                                        • Instruction ID: 44ed1003e9c7bc8b19f3fdc78ae7ecd0c94e6a04e93c3a334f4e6b92dd6cfd77
                                                                                                                                                        • Opcode Fuzzy Hash: facb527fe486dfc3fc3d87f2375e4c643ff25ae6e63a15fa277d8cd95c3230da
                                                                                                                                                        • Instruction Fuzzy Hash: 04014F72954659ABEB118B54DC09FAEBFB9FB08B11F040629F811A22D0DB749944DA90
                                                                                                                                                        Function 00521F08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00521E0E,?,?,00000000,00000000,00000000,?), ref: 00521F2D
                                                                                                                                                        • CatchIt.LIBVCRUNTIME ref: 00522013
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CatchEncodePointer
                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                        • API String ID: 1435073870-2084237596
                                                                                                                                                        • Opcode ID: f146a4f4fdc60c38d494519a2debc56b512c809ed449cc619f4a9f5b9ac737fc
                                                                                                                                                        • Instruction ID: 70d65da5a048f2690b0e42a9912f81b9840eec3ca98f3c6b3e9deb5fa391f308
                                                                                                                                                        • Opcode Fuzzy Hash: f146a4f4fdc60c38d494519a2debc56b512c809ed449cc619f4a9f5b9ac737fc
                                                                                                                                                        • Instruction Fuzzy Hash: BD41A972900219AFCF19CF94ED85AEEBFB5FF49300F188058F914A72A1D335A951DBA0
                                                                                                                                                        Function 00529081 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000008,00000000,00000800,?,0052911D,?,-00000001,-00000001,?,?,?,00528F65,00000000,FlsAlloc,00532824,0053282C), ref: 0052908E
                                                                                                                                                        • GetLastError.KERNEL32(?,0052911D,?,-00000001,-00000001,?,?,?,00528F65,00000000,FlsAlloc,00532824,0053282C,?,-00000001,005211F1), ref: 00529098
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000008,00000000,00000000,00538A38,00000008,004EAC6A), ref: 005290C0
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                        • API String ID: 3177248105-2084034818
                                                                                                                                                        • Opcode ID: 7108932ed3c8922f2a3cb5941bf3150ae448eef561934624bfae87d41f8f4c64
                                                                                                                                                        • Instruction ID: 20f7e5cb003ee46b48323bda55975864eb28e6e08601a33182b4fceefbb68de1
                                                                                                                                                        • Opcode Fuzzy Hash: 7108932ed3c8922f2a3cb5941bf3150ae448eef561934624bfae87d41f8f4c64
                                                                                                                                                        • Instruction Fuzzy Hash: 1EE04F71A8460CB7EB301B61FC0AB5C3F94BF25B41F104020F90CE92E5E7A1E915A988
                                                                                                                                                        Function 00529A3F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetConsoleOutputCP.KERNEL32(D2AA1F0E,00000000,00000000,?), ref: 00529AA2
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00529CF4
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00529D3A
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00529DDD
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2112829910-0
                                                                                                                                                        • Opcode ID: c8951896db29eff0390352c96d5f209eb154277756c6ccd5ea4b25ff28c161e0
                                                                                                                                                        • Instruction ID: 8d9cb56d5d5df2b43d74483e379606aabcbd0c4d1d5c5000e508341fed1eb24b
                                                                                                                                                        • Opcode Fuzzy Hash: c8951896db29eff0390352c96d5f209eb154277756c6ccd5ea4b25ff28c161e0
                                                                                                                                                        • Instruction Fuzzy Hash: 5ED18AB5D042699FCF14CFA8E8849EDBFB4FF4A300F24452AE456EB392D630A945CB50
                                                                                                                                                        Function 0052190C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AdjustPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1740715915-0
                                                                                                                                                        • Opcode ID: 7b3a18acbb794778c04c5c965084f9fbddfe8fbd224fded99feae239d3080ffc
                                                                                                                                                        • Instruction ID: 296bb57558fa2788b73c3bf122532e147c49df20566aff572f4ed999fc3e0fea
                                                                                                                                                        • Opcode Fuzzy Hash: 7b3a18acbb794778c04c5c965084f9fbddfe8fbd224fded99feae239d3080ffc
                                                                                                                                                        • Instruction Fuzzy Hash: FB51F272602A26AFEB298F50E855BBB7FA4FF62310F24052DE805572D1E731AC80C794
                                                                                                                                                        Function 004EE0C0 Relevance: 6.1, APIs: 4, Instructions: 94threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004EE0FC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2882836952-0
                                                                                                                                                        • Opcode ID: 86f6716092cd18e2372f22921611a1617987aaf91f5fde02fb865e6849f1741d
                                                                                                                                                        • Instruction ID: 5edaf0179aeb704250ba323420d0a6c0c9cec44fe7ec35a4814f226bbcadc8cc
                                                                                                                                                        • Opcode Fuzzy Hash: 86f6716092cd18e2372f22921611a1617987aaf91f5fde02fb865e6849f1741d
                                                                                                                                                        • Instruction Fuzzy Hash: 23214874A442818FDB345B1BCC8676ABBD0AF89711F24482BF44ACB361D675CCC4974B
                                                                                                                                                        Function 00526155 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,?,005264FB,?,?,?,00000000), ref: 005261B9
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 005261C0
                                                                                                                                                        • GetLastError.KERNEL32(00000000,005264FB,?,?,00000000,?,?,?,00000000,00000000,?,005264FB,?,?,?,00000000), ref: 005261FA
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00526201
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1913693674-0
                                                                                                                                                        • Opcode ID: 4d1a6829e5e7890ddc76033caea71163f6c8a05ef048588a8948280c6b99ab62
                                                                                                                                                        • Instruction ID: 515c7059d344d2e26daff77ecb5ce7541ae6556eabc0573291f446254cf7652b
                                                                                                                                                        • Opcode Fuzzy Hash: 4d1a6829e5e7890ddc76033caea71163f6c8a05ef048588a8948280c6b99ab62
                                                                                                                                                        • Instruction Fuzzy Hash: AD21B37160473AAFDB20AF65EC8582FBFA9FF963647104558F81597292D730EC50CB50
                                                                                                                                                        Function 00526EAB Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 00526EB3
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00526EEB
                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00526F0B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 158306478-0
                                                                                                                                                        • Opcode ID: 5dbcdcdf7bbc5dc22a4b1515f7bdf47aa57e9c93223e241de0666b352723a76e
                                                                                                                                                        • Instruction ID: a8e6d052888f45ac3012676f7f2b1029a06d97a00fae862fcbbd471070fdf847
                                                                                                                                                        • Opcode Fuzzy Hash: 5dbcdcdf7bbc5dc22a4b1515f7bdf47aa57e9c93223e241de0666b352723a76e
                                                                                                                                                        • Instruction Fuzzy Hash: 7D11A1F291953A7F6B2167B27E8DC7F2D5CFEAB3947100464F50191281EA64CE4191B0
                                                                                                                                                        Function 0052EA4B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,?,-00000001,00000000,00000000,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000), ref: 0052EA62
                                                                                                                                                        • GetLastError.KERNEL32(?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?,?,?,00529777,?), ref: 0052EA6E
                                                                                                                                                          • Part of subcall function 0052EAC0: CloseHandle.KERNEL32(FFFFFFFE,0052EA7E,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?,?), ref: 0052EAD0
                                                                                                                                                        • ___initconout.LIBCMT ref: 0052EA7E
                                                                                                                                                          • Part of subcall function 0052EAA0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0052EA3C,0052D9AB,?,?,00529E31,?,00000000,00000000,?), ref: 0052EAB3
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,?,-00000001,00000000,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?), ref: 0052EA93
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2744216297-0
                                                                                                                                                        • Opcode ID: 0b312deea0d300b70540724452b1264dc414b961ca2e224c548c6bed094aed26
                                                                                                                                                        • Instruction ID: 36ca6ad64cc6af21a317ec16feff8c05a51795d7570fa86c8f92f00dc85b63a5
                                                                                                                                                        • Opcode Fuzzy Hash: 0b312deea0d300b70540724452b1264dc414b961ca2e224c548c6bed094aed26
                                                                                                                                                        • Instruction Fuzzy Hash: 3FF03736500129BBCF225F91EC0E99D3F66FF593A1B054010FA09D5270C7729924FB90
                                                                                                                                                        Function 0052177C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00521785
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000008.00000002.3012943516.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 00000008.00000002.3012928560.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3012977237.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013013416.0000000000539000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013027332.000000000053A000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013040527.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 00000008.00000002.3013093898.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_8_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___except_validate_context_record
                                                                                                                                                        • String ID: csm$csm
                                                                                                                                                        • API String ID: 3493665558-3733052814
                                                                                                                                                        • Opcode ID: 84fca27631db27ad021245c88becad393186ceed78c7508958c4ee27411a1078
                                                                                                                                                        • Instruction ID: 12442678c8624a6ebae1f73a37871c223f253a3062bf81fadd456c9a2124554e
                                                                                                                                                        • Opcode Fuzzy Hash: 84fca27631db27ad021245c88becad393186ceed78c7508958c4ee27411a1078
                                                                                                                                                        • Instruction Fuzzy Hash: 69312836400635EFCF268F50EC849AB7F65FF6A715B18865AF814591A1C332CC62DBC5

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:12.7%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                        Total number of Nodes:18
                                                                                                                                                        Total number of Limit Nodes:0

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00007FFD34697F64 Relevance: 1.6, APIs: 1, Instructions: 150injectionCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1770 7ffd34697f64-7ffd34697f6b 1771 7ffd34697f76-7ffd34697f8a 1770->1771 1772 7ffd34697f6d-7ffd34697f75 1770->1772 1773 7ffd34697f8c-7ffd34697fbf 1771->1773 1774 7ffd34697fc0-7ffd34698005 1771->1774 1772->1771 1773->1774 1778 7ffd34698007-7ffd3469800c 1774->1778 1779 7ffd3469800f-7ffd34698064 WriteProcessMemory 1774->1779 1778->1779 1781 7ffd34698066 1779->1781 1782 7ffd3469806c-7ffd3469809d 1779->1782 1781->1782
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MemoryProcessWrite
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3559483778-0
                                                                                                                                                        • Opcode ID: 80f7fba1db654c150251754380e5e9dfc73fdb4232442d7bc4ce4762cdf5a6a0
                                                                                                                                                        • Instruction ID: 4fc1938261509a5a11c70deae2893693fc5d95b7356e9acc764a8a09b51bb5ea
                                                                                                                                                        • Opcode Fuzzy Hash: 80f7fba1db654c150251754380e5e9dfc73fdb4232442d7bc4ce4762cdf5a6a0
                                                                                                                                                        • Instruction Fuzzy Hash: AB41E832D0CB5C8FDB299F9898566F97BE0EB95311F00426FE449D3282DE78A845C792
                                                                                                                                                        Function 00007FFD346980A1 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1784 7ffd346980a1-7ffd346980ad 1785 7ffd346980b8-7ffd346980ca 1784->1785 1786 7ffd346980af-7ffd346980b7 1784->1786 1787 7ffd346980cc-7ffd346980ff 1785->1787 1788 7ffd34698100-7ffd34698199 ReadProcessMemory 1785->1788 1786->1785 1787->1788 1793 7ffd3469819b 1788->1793 1794 7ffd346981a1-7ffd346981d2 1788->1794 1793->1794
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MemoryProcessRead
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1726664587-0
                                                                                                                                                        • Opcode ID: 716be3353f66fadd172695de48acc0bad1c0ae9c696dba97a1a1ad2a99ea2488
                                                                                                                                                        • Instruction ID: 218e237f916371d1c666e340badec4530c9566aa105c80934a48d98208c313e2
                                                                                                                                                        • Opcode Fuzzy Hash: 716be3353f66fadd172695de48acc0bad1c0ae9c696dba97a1a1ad2a99ea2488
                                                                                                                                                        • Instruction Fuzzy Hash: BE41F83191CB5C8FDB29DF9898566FD7BE0EF95321F00426FE089D3292CA746845C792
                                                                                                                                                        Function 00007FFD34697E60 Relevance: 1.6, APIs: 1, Instructions: 132memoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1796 7ffd34697e60-7ffd34697e67 1797 7ffd34697e69-7ffd34697e71 1796->1797 1798 7ffd34697e72-7ffd34697e7a 1796->1798 1797->1798 1799 7ffd34697e7c-7ffd34697ead 1798->1799 1800 7ffd34697eb0-7ffd34697f31 VirtualAllocEx 1798->1800 1799->1800 1804 7ffd34697f39-7ffd34697f5f 1800->1804 1805 7ffd34697f33 1800->1805 1805->1804
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                        • Opcode ID: 085e85954f55d5a3e7d257248c4f86af79e28fc5f2470fa27b580835c22de19c
                                                                                                                                                        • Instruction ID: 073958d88e60405b8a75589a49be1a55c553a11b140fd59bb619ec54267473cc
                                                                                                                                                        • Opcode Fuzzy Hash: 085e85954f55d5a3e7d257248c4f86af79e28fc5f2470fa27b580835c22de19c
                                                                                                                                                        • Instruction Fuzzy Hash: 67312C31A1CB4D4FDB1DAB9898166F97BE0EB55321F00023ED049D3252DA74781687D5
                                                                                                                                                        Function 00007FFD346985BA Relevance: 1.6, APIs: 1, Instructions: 130processCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1807 7ffd346985ba-7ffd3469866d CreateProcessA 1810 7ffd34698675-7ffd34698706 call 7ffd34698722 1807->1810 1811 7ffd3469866f 1807->1811 1820 7ffd34698708 1810->1820 1821 7ffd3469870d-7ffd34698721 1810->1821 1811->1810 1820->1821
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateProcess
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 963392458-0
                                                                                                                                                        • Opcode ID: fec4fef8983170b8f35dc2e075af0f9cd875a01c4b6fa832355d71133e22b798
                                                                                                                                                        • Instruction ID: 692f42aecd07375d3a48ece017f09bfb113aa18202ab3866b072cbacab7b4db4
                                                                                                                                                        • Opcode Fuzzy Hash: fec4fef8983170b8f35dc2e075af0f9cd875a01c4b6fa832355d71133e22b798
                                                                                                                                                        • Instruction Fuzzy Hash: D5419231608B8C8FDB65EF48D8957E977E1FF69310F00422AE84DDB252CA39A944CB91
                                                                                                                                                        Function 00007FFD34697D58 Relevance: 1.6, APIs: 1, Instructions: 126threadCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1822 7ffd34697d58-7ffd34697d5f 1823 7ffd34697d6a-7ffd34697ddd 1822->1823 1824 7ffd34697d61-7ffd34697d69 1822->1824 1828 7ffd34697de7-7ffd34697e22 Wow64SetThreadContext 1823->1828 1829 7ffd34697ddf-7ffd34697de4 1823->1829 1824->1823 1831 7ffd34697e2a-7ffd34697e59 1828->1831 1832 7ffd34697e24 1828->1832 1829->1828 1832->1831
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ContextThreadWow64
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 983334009-0
                                                                                                                                                        • Opcode ID: f90eea78d3e0822cdbeecb2f20fe723df44729ac6448f542bbaed90cd89cfe9a
                                                                                                                                                        • Instruction ID: 72a2cab118fed95ac4b1ba90c7ab1b402d2cb957db3f7668062f6bd89bf2600c
                                                                                                                                                        • Opcode Fuzzy Hash: f90eea78d3e0822cdbeecb2f20fe723df44729ac6448f542bbaed90cd89cfe9a
                                                                                                                                                        • Instruction Fuzzy Hash: 8731E831D0CB584FDB299FA8985A6FABBE1EF56321F04422FD049D3192DB7468068791
                                                                                                                                                        Function 00007FFD34697C5D Relevance: 1.6, APIs: 1, Instructions: 120threadCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1834 7ffd34697c5d-7ffd34697c69 1835 7ffd34697c6b-7ffd34697c73 1834->1835 1836 7ffd34697c74-7ffd34697c83 1834->1836 1835->1836 1837 7ffd34697c85-7ffd34697c8d 1836->1837 1838 7ffd34697c8e-7ffd34697c9a 1836->1838 1837->1838 1839 7ffd34697c9c-7ffd34697ccf 1838->1839 1840 7ffd34697cd0-7ffd34697d24 ResumeThread 1838->1840 1839->1840 1845 7ffd34697d26 1840->1845 1846 7ffd34697d2c-7ffd34697d51 1840->1846 1845->1846
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000B.00000002.3000563302.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_11_2_7ffd34690000_Application.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ResumeThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 947044025-0
                                                                                                                                                        • Opcode ID: e9b09ed284d7bc487180263073c963604d2100dfa6b52677324c87033d67b68a
                                                                                                                                                        • Instruction ID: 21294aabc934d2ab96e10bf539a73ecab356041b8cdbfe97550e9c7aa29acd58
                                                                                                                                                        • Opcode Fuzzy Hash: e9b09ed284d7bc487180263073c963604d2100dfa6b52677324c87033d67b68a
                                                                                                                                                        • Instruction Fuzzy Hash: 3831F631A0C7888FDB5ADFA888566E97FE0EF57321F0842AFD089D7193DA786406C751

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:0.5%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                        Total number of Nodes:113
                                                                                                                                                        Total number of Limit Nodes:3
                                                                                                                                                        execution_graph 28682 436fe7 GetLastError 28683 437004 28682->28683 28684 436ffe 28682->28684 28702 43700a SetLastError 28683->28702 28705 438a5f 28683->28705 28717 438a20 6 API calls std::_Lockit::_Lockit 28684->28717 28691 437051 28694 438a5f __dosmaperr 6 API calls 28691->28694 28692 43703a 28693 438a5f __dosmaperr 6 API calls 28692->28693 28695 437048 28693->28695 28696 43705d 28694->28696 28718 438279 14 API calls _free 28695->28718 28697 437072 28696->28697 28698 437061 28696->28698 28719 436cbe 14 API calls __dosmaperr 28697->28719 28700 438a5f __dosmaperr 6 API calls 28698->28700 28700->28695 28703 43707d 28720 438279 14 API calls _free 28703->28720 28721 43880f 28705->28721 28708 437022 28708->28702 28710 43a88d 28708->28710 28709 438a99 TlsSetValue 28711 43a89a __dosmaperr 28710->28711 28712 43a8da 28711->28712 28713 43a8c5 RtlAllocateHeap 28711->28713 28735 433a53 EnterCriticalSection LeaveCriticalSection std::_Facet_Register 28711->28735 28736 4312e2 14 API calls __dosmaperr 28712->28736 28713->28711 28714 437032 28713->28714 28714->28691 28714->28692 28717->28683 28718->28702 28719->28703 28720->28702 28722 438839 28721->28722 28723 43883d 28721->28723 28722->28708 28722->28709 28723->28722 28728 438748 28723->28728 28726 438857 GetProcAddress 28726->28722 28727 438867 std::_Lockit::_Lockit 28726->28727 28727->28722 28733 438759 ___vcrt_FlsFree 28728->28733 28729 438804 28729->28722 28729->28726 28730 438777 LoadLibraryExW 28731 438792 GetLastError 28730->28731 28730->28733 28731->28733 28732 4387ed FreeLibrary 28732->28733 28733->28729 28733->28730 28733->28732 28734 4387c5 LoadLibraryExW 28733->28734 28734->28733 28735->28711 28736->28714 28737 42a495 28738 42a4a1 ___scrt_is_nonwritable_in_current_image 28737->28738 28763 42a1bb 28738->28763 28740 42a4a8 28741 42a601 28740->28741 28751 42a4d2 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock std::locale::_Setgloballocale 28740->28751 28789 42a805 4 API calls 2 library calls 28741->28789 28743 42a608 28785 42e2be 28743->28785 28747 42a616 28748 42a4f1 28749 42a572 28771 4343dd 28749->28771 28751->28748 28751->28749 28788 42e298 37 API calls 4 library calls 28751->28788 28753 42a578 28775 421110 28753->28775 28764 42a1c4 28763->28764 28791 42a9ef IsProcessorFeaturePresent 28764->28791 28766 42a1d0 28792 42cad9 10 API calls 2 library calls 28766->28792 28768 42a1d5 28769 42a1d9 28768->28769 28793 42caf8 7 API calls 2 library calls 28768->28793 28769->28740 28772 4343eb 28771->28772 28773 4343e6 28771->28773 28772->28753 28794 433f38 49 API calls 28773->28794 28776 42111b 28775->28776 28795 4113c0 113 API calls __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ 28776->28795 28778 421125 28796 411c50 119 API calls 2 library calls 28778->28796 28780 42112a 28797 41f7e0 125 API calls 2 library calls 28780->28797 28782 42112f 28783 4210d0 CreateThread CreateThread 28782->28783 28784 421100 Sleep 28783->28784 28784->28784 28798 42e15c 28785->28798 28788->28749 28789->28743 28790 42e282 23 API calls std::locale::_Setgloballocale 28790->28747 28791->28766 28792->28768 28793->28769 28794->28772 28795->28778 28796->28780 28797->28782 28799 42e16a 28798->28799 28800 42e17c 28798->28800 28826 42a925 GetModuleHandleW 28799->28826 28810 42e003 28800->28810 28804 42e16f 28804->28800 28827 42e202 GetModuleHandleExW 28804->28827 28805 42a60e 28805->28790 28808 42e1bf 28811 42e00f ___scrt_is_nonwritable_in_current_image 28810->28811 28833 432770 EnterCriticalSection 28811->28833 28813 42e019 28834 42e06f 28813->28834 28815 42e026 28838 42e044 28815->28838 28818 42e1c0 28843 4363b2 GetPEB 28818->28843 28821 42e1ef 28824 42e202 std::locale::_Setgloballocale 3 API calls 28821->28824 28822 42e1cf GetPEB 28822->28821 28823 42e1df GetCurrentProcess TerminateProcess 28822->28823 28823->28821 28825 42e1f7 ExitProcess 28824->28825 28826->28804 28828 42e221 GetProcAddress 28827->28828 28829 42e244 28827->28829 28830 42e236 28828->28830 28831 42e17b 28829->28831 28832 42e24a FreeLibrary 28829->28832 28830->28829 28831->28800 28832->28831 28833->28813 28835 42e07b ___scrt_is_nonwritable_in_current_image 28834->28835 28837 42e0dc std::locale::_Setgloballocale 28835->28837 28841 4346c5 14 API calls std::locale::_Setgloballocale 28835->28841 28837->28815 28842 4327b8 LeaveCriticalSection 28838->28842 28840 42e032 28840->28805 28840->28818 28841->28837 28842->28840 28844 4363cc 28843->28844 28846 42e1ca 28843->28846 28847 438892 28844->28847 28846->28821 28846->28822 28848 43880f std::_Lockit::_Lockit 5 API calls 28847->28848 28849 4388ae 28848->28849 28849->28846

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 0042E1C0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?,0042E1BF,?,?,?,?,?,0042F14E), ref: 0042E1E2
                                                                                                                                                        • TerminateProcess.KERNEL32(00000000,?,0042E1BF,?,?,?,?,?,0042F14E), ref: 0042E1E9
                                                                                                                                                        • ExitProcess.KERNEL32 ref: 0042E1FB
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                                        • Opcode ID: 5c151c6d6e5f4eaeb0006500acd1cf09f10172c413f3a79ee04b59d5065b03af
                                                                                                                                                        • Instruction ID: beeb55568124b43b6d1949a26483228865c766f469b8daeaf670a55c7efeec5f
                                                                                                                                                        • Opcode Fuzzy Hash: 5c151c6d6e5f4eaeb0006500acd1cf09f10172c413f3a79ee04b59d5065b03af
                                                                                                                                                        • Instruction Fuzzy Hash: BCE0B631100258ABCB116B5AED49A693B69EB44342F45446AF809DA232CB39DD91CA98
                                                                                                                                                        Function 00438748 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 0 438748-438754 1 4387fb-4387fe 0->1 2 438804 1->2 3 438759-43876a 1->3 6 438806-43880a 2->6 4 438777-438790 LoadLibraryExW 3->4 5 43876c-43876f 3->5 9 4387e2-4387eb 4->9 10 438792-43879b GetLastError 4->10 7 438775 5->7 8 4387f8 5->8 11 4387f4-4387f6 7->11 8->1 9->11 12 4387ed-4387ee FreeLibrary 9->12 13 4387d2 10->13 14 43879d-4387af call 436378 10->14 11->8 16 43880b-43880d 11->16 12->11 15 4387d4-4387d6 13->15 14->13 20 4387b1-4387c3 call 436378 14->20 15->9 18 4387d8-4387e0 15->18 16->6 18->8 20->13 23 4387c5-4387d0 LoadLibraryExW 20->23 23->15
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                                        • API String ID: 0-537541572
                                                                                                                                                        • Opcode ID: 88aac227e8c5ff874c20370595e8ddb3b6c3d611fb52fe3b7ea9f0aa0788f727
                                                                                                                                                        • Instruction ID: cdeb2836aeb2a2b963ff05e66d4687729ff2dbfa8dd0c97b18030816bfb45ad1
                                                                                                                                                        • Opcode Fuzzy Hash: 88aac227e8c5ff874c20370595e8ddb3b6c3d611fb52fe3b7ea9f0aa0788f727
                                                                                                                                                        • Instruction Fuzzy Hash: 1021A471A01311BBCB219A259C84B1BB659AB097A1F35212AFC15A7291DB38ED01C6AD
                                                                                                                                                        Function 00436FE7 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,004312E7,00402397), ref: 00436FEC
                                                                                                                                                        • _free.LIBCMT ref: 00437049
                                                                                                                                                        • _free.LIBCMT ref: 0043707F
                                                                                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,004312E7,00402397), ref: 0043708A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2283115069-0
                                                                                                                                                        • Opcode ID: af12cff4d2f8ba072691e30dbff60fa0c5db440dcd923b1ae4d2776dab200245
                                                                                                                                                        • Instruction ID: 1d79af9b921e9ca9f8c55d2b366a00ff7623c969e23b16d91bfee06b9f9caf0b
                                                                                                                                                        • Opcode Fuzzy Hash: af12cff4d2f8ba072691e30dbff60fa0c5db440dcd923b1ae4d2776dab200245
                                                                                                                                                        • Instruction Fuzzy Hash: D711A3B22083017AC72537669C81D272269978D778F21273FF1A4922F2EE6D8C41551D
                                                                                                                                                        Function 0043880F Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 65 43880f-438837 66 438839-43883b 65->66 67 43883d-43883f 65->67 68 43888e-438891 66->68 69 438841-438843 67->69 70 438845-43884c call 438748 67->70 69->68 72 438851-438855 70->72 73 438857-438865 GetProcAddress 72->73 74 438874-43888b 72->74 73->74 75 438867-438872 call 42e050 73->75 76 43888d 74->76 75->76 76->68
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: ae19f906fb98a4018a970a5f0b15a76f00d11586b0f11cae3c1ed1102798adc2
                                                                                                                                                        • Instruction ID: 83c0b23be62c976b7c0e61ba2f8d0ed27652c7ccab87382c83273ac3bab5d36e
                                                                                                                                                        • Opcode Fuzzy Hash: ae19f906fb98a4018a970a5f0b15a76f00d11586b0f11cae3c1ed1102798adc2
                                                                                                                                                        • Instruction Fuzzy Hash: 2C0168337003145F9F199F2AEC40A8B77DAAB89370B64513AF900CB284EE34CC01838A
                                                                                                                                                        Function 0043A88D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 79 43a88d-43a898 80 43a8a6-43a8ac 79->80 81 43a89a-43a8a4 79->81 83 43a8c5-43a8d6 RtlAllocateHeap 80->83 84 43a8ae-43a8af 80->84 81->80 82 43a8da-43a8e5 call 4312e2 81->82 88 43a8e7-43a8e9 82->88 85 43a8b1-43a8b8 call 436207 83->85 86 43a8d8 83->86 84->83 85->82 92 43a8ba-43a8c3 call 433a53 85->92 86->88 92->82 92->83
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00437032,00000001,00000364,00000006,000000FF,?,004312E7,00402397), ref: 0043A8CE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: 04750640ddbe8b1e3399d674a7a03641a9003a26188de75eca11df44564e095f
                                                                                                                                                        • Instruction ID: ab8f3d730899ebbc3b9248b3e1dafce82b849062dbceacdf2a8c7bf2fc11f98c
                                                                                                                                                        • Opcode Fuzzy Hash: 04750640ddbe8b1e3399d674a7a03641a9003a26188de75eca11df44564e095f
                                                                                                                                                        • Instruction Fuzzy Hash: 14F02B311815206ADB283A568C00B577748AF49360F146027A88596290CA2CDC1297AE

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 004061F0 Relevance: 84.0, APIs: 40, Strings: 7, Instructions: 1737registrywindowfileCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,70BC39D9,70BC39D9), ref: 0040639C
                                                                                                                                                        • RegQueryValueExA.ADVAPI32(70BC39D9,?,00000000,00000000,?,00000400,?,?,00000000,00000001,70BC39D9,70BC39D9), ref: 004063CA
                                                                                                                                                        • RegCloseKey.ADVAPI32(70BC39D9,?,?,00000000,00000001,70BC39D9,70BC39D9), ref: 004063D6
                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 004064E3
                                                                                                                                                        • RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00406511
                                                                                                                                                        • RegCloseKey.ADVAPI32(80000001), ref: 0040651A
                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0040663C
                                                                                                                                                        • RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0040665F
                                                                                                                                                          • Part of subcall function 004061F0: RegOpenKeyExA.ADVAPI32(?,00000000), ref: 004067BD
                                                                                                                                                          • Part of subcall function 004061F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00406894
                                                                                                                                                          • Part of subcall function 004061F0: RegEnumValueA.ADVAPI32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 004068E0
                                                                                                                                                        • RegCloseKey.ADVAPI32(80000002), ref: 00406668
                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00406D5E
                                                                                                                                                        • GdiplusStartup.GDIPLUS(?,?,00000000,70BC39D9,00000000), ref: 00406DEA
                                                                                                                                                        • GetDC.USER32(00000000), ref: 00406F62
                                                                                                                                                        • RegGetValueA.ADVAPI32(80000002,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004071CD
                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 00407226
                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 0040722F
                                                                                                                                                        • RegGetValueA.ADVAPI32(80000002,?,00000000), ref: 00407277
                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 004072CA
                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 004072D3
                                                                                                                                                        • CreateCompatibleDC.GDI32(?), ref: 004072DF
                                                                                                                                                        • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004072F4
                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00407304
                                                                                                                                                        • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0040732A
                                                                                                                                                        • GdipCreateBitmapFromHBITMAP.GDIPLUS(00000000,00000000,?), ref: 0040733E
                                                                                                                                                        • GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 0040735A
                                                                                                                                                        • GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 00407387
                                                                                                                                                        • GdipSaveImageToFile.GDIPLUS(00000000,00000000,?,00000000), ref: 0040740E
                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 0040741B
                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00407428
                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00407430
                                                                                                                                                        • ReleaseDC.USER32(00000000,?), ref: 0040743A
                                                                                                                                                        • GdipDisposeImage.GDIPLUS(00000000), ref: 00407441
                                                                                                                                                        • GdiplusShutdown.GDIPLUS(?), ref: 004074E3
                                                                                                                                                        • GetUserNameA.ADVAPI32(?,?), ref: 004075BA
                                                                                                                                                        • LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00407600
                                                                                                                                                        • GetSidIdentifierAuthority.ADVAPI32(?), ref: 0040760D
                                                                                                                                                        • GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407721
                                                                                                                                                        • GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00407748
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Value$Gdip$CloseImageMetricsObjectOpenSystem$AuthorityCreate$BitmapCompatibleDeleteEncodersGdiplusNameQuerySelect$AccountCountDisposeEnumFileFromIdentifierInfoLookupReleaseSaveShutdownSizeStartupUser
                                                                                                                                                        • String ID: $($NtUnmapViewOfSection$image/jpeg$invalid stoi argument$ntdll.dll$stoi argument out of range
                                                                                                                                                        • API String ID: 1729688432-36074161
                                                                                                                                                        • Opcode ID: 96841d841959d5a5ece1a95f71dada02b43a38451eb313863f465adbea374227
                                                                                                                                                        • Instruction ID: af65bfa764270b5ce9775eb08fbd4872c905d4291e0f26b734305f397325d2b9
                                                                                                                                                        • Opcode Fuzzy Hash: 96841d841959d5a5ece1a95f71dada02b43a38451eb313863f465adbea374227
                                                                                                                                                        • Instruction Fuzzy Hash: 59D22771A001189BDB14DF28CD85BDDBB75EF45304F5082AEE805E72D2DB38AA94CF99
                                                                                                                                                        Function 00408070 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121memoryprocessthreadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040809D
                                                                                                                                                        • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 004080FB
                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00408114
                                                                                                                                                        • GetThreadContext.KERNEL32(?,00000000), ref: 00408129
                                                                                                                                                        • ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00408149
                                                                                                                                                        • VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040818B
                                                                                                                                                        • WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 004081A8
                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00408261
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
                                                                                                                                                        • String ID: $VUUU$invalid stoi argument
                                                                                                                                                        • API String ID: 3796053839-3954507777
                                                                                                                                                        • Opcode ID: 62d95fcd76c5f25c62508e9bc95ebb17d9faf2542a0d874549bfb0d78f9c36e9
                                                                                                                                                        • Instruction ID: ec2ec405b4feb77d8b7b6e7cd90d4c1357cbc692e2c72a62d3d4830771f4c8b3
                                                                                                                                                        • Opcode Fuzzy Hash: 62d95fcd76c5f25c62508e9bc95ebb17d9faf2542a0d874549bfb0d78f9c36e9
                                                                                                                                                        • Instruction Fuzzy Hash: B0416D70644741AFE7209B60DD06F57BBE8BF88B05F400429F784E61E1DBB4E9548B9A
                                                                                                                                                        Function 0043EA8E Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 0043EB4B
                                                                                                                                                        • _free.LIBCMT ref: 0043ED17
                                                                                                                                                        • _free.LIBCMT ref: 0043ED8F
                                                                                                                                                        • GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0043EF50,?,?,00000000), ref: 0043EDA1
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$InformationTimeZone
                                                                                                                                                        • String ID: PC$PC$XC
                                                                                                                                                        • API String ID: 597776487-1095605717
                                                                                                                                                        • Opcode ID: 10af01855852b165286abef80efac0089e4ced1f075bf25bdc5770eddd4ea2d5
                                                                                                                                                        • Instruction ID: cd3dd21302477c4ec91c3fbc825ef0196a500e29d139f090a3f0a9df705cb678
                                                                                                                                                        • Opcode Fuzzy Hash: 10af01855852b165286abef80efac0089e4ced1f075bf25bdc5770eddd4ea2d5
                                                                                                                                                        • Instruction Fuzzy Hash: FCA12471A01215ABDB10AF67DC42AAFBBB9EF08314F10506FF901972D1EB789D40CB99
                                                                                                                                                        Function 00442226 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • GetACP.KERNEL32(?,?,?,?,?,?,00435299,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 004422E7
                                                                                                                                                        • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00435299,?,?,?,00000055,?,-00000050,?,?), ref: 00442312
                                                                                                                                                        • _wcschr.LIBVCRUNTIME ref: 004423A6
                                                                                                                                                        • _wcschr.LIBVCRUNTIME ref: 004423B4
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00442475
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
                                                                                                                                                        • String ID: <iE$utf8
                                                                                                                                                        • API String ID: 4147378913-3590743787
                                                                                                                                                        • Opcode ID: e3e8b9743329bd35a0dc30a48afc358f3413f1c59876c2bc82b717f4c1b4ece7
                                                                                                                                                        • Instruction ID: c53d09d64b8cc9efe53727a29dc6db101ffd2d54c10202840999cd46ab44894d
                                                                                                                                                        • Opcode Fuzzy Hash: e3e8b9743329bd35a0dc30a48afc358f3413f1c59876c2bc82b717f4c1b4ece7
                                                                                                                                                        • Instruction Fuzzy Hash: 7B711A31600302AAF724AB36DD46BAB73A8EF48704F54446FF505D7282EAFCD945866D
                                                                                                                                                        Function 00442B87 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436EF2
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436F28
                                                                                                                                                        • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00442C93
                                                                                                                                                        • IsValidCodePage.KERNEL32(00000000), ref: 00442CDC
                                                                                                                                                        • IsValidLocale.KERNEL32(?,00000001), ref: 00442CEB
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00442D33
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00442D52
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
                                                                                                                                                        • String ID: <iE
                                                                                                                                                        • API String ID: 949163717-1622777879
                                                                                                                                                        • Opcode ID: 0316a29e2c5f248da2bdf9bcce5754a7af42af65c6343b2b2b8b97a9dc76958e
                                                                                                                                                        • Instruction ID: f0b0e7a5d56bcbe51e00e742245fabdee816dc7c20859267b4c91a9259e7c11a
                                                                                                                                                        • Opcode Fuzzy Hash: 0316a29e2c5f248da2bdf9bcce5754a7af42af65c6343b2b2b8b97a9dc76958e
                                                                                                                                                        • Instruction Fuzzy Hash: FB518371900205ABEB10DFA5CD85BBFB7B8FF48701F85446AB901E7251EBB89904CB69
                                                                                                                                                        Function 004429B2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,2000000B,00442CD0,00000002,00000000,?,?,?,00442CD0,?,00000000), ref: 00442A4B
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,20001004,00442CD0,00000002,00000000,?,?,?,00442CD0,?,00000000), ref: 00442A74
                                                                                                                                                        • GetACP.KERNEL32(?,?,00442CD0,?,00000000), ref: 00442A89
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoLocale
                                                                                                                                                        • String ID: ACP$OCP
                                                                                                                                                        • API String ID: 2299586839-711371036
                                                                                                                                                        • Opcode ID: 91a725e87c4abdde2c3ba79189987a9e356afb43ab7769cbf64fa30edc92bff9
                                                                                                                                                        • Instruction ID: 1fcbb438231c53f21d0fb05519173cac2c978cfb8c59f46622b2a69faa1100e3
                                                                                                                                                        • Opcode Fuzzy Hash: 91a725e87c4abdde2c3ba79189987a9e356afb43ab7769cbf64fa30edc92bff9
                                                                                                                                                        • Instruction Fuzzy Hash: 9121C122700101ABFB308F54CB04BA7B3A6AB54F54BD68066FD06E7314E7B6DE42C358
                                                                                                                                                        Function 004093D0 Relevance: 6.2, APIs: 4, Instructions: 181COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetVersionExW.KERNEL32(0000011C,70BC39D9,0000000F,00000000), ref: 0040944A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Version
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1889659487-0
                                                                                                                                                        • Opcode ID: b5dbd5776d6dcd19d43739984f9e21c2021b448fcb9ccb835e9a5f9429841fcf
                                                                                                                                                        • Instruction ID: 066e72931073444615a2231536368ae4fcf2e2d6cddb25601ed63aa4f4e63178
                                                                                                                                                        • Opcode Fuzzy Hash: b5dbd5776d6dcd19d43739984f9e21c2021b448fcb9ccb835e9a5f9429841fcf
                                                                                                                                                        • Instruction Fuzzy Hash: 8961C6B0D04254EBDF20AF64DD5679EBB74AB45314F5002AEE405A73C3EB785E848B8A
                                                                                                                                                        Function 0042A805 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042A811
                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 0042A8DD
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042A8FD
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0042A907
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 254469556-0
                                                                                                                                                        • Opcode ID: dd802e56b012410f2d65ca8513fa030bd62c8920624d701d61c4eb487f972de1
                                                                                                                                                        • Instruction ID: 1ecff19f8cffd3358e10d64be25db110c70aa2275a1f3f7afbe61523e161ea32
                                                                                                                                                        • Opcode Fuzzy Hash: dd802e56b012410f2d65ca8513fa030bd62c8920624d701d61c4eb487f972de1
                                                                                                                                                        • Instruction Fuzzy Hash: 58313CB5D0131C9BDB10DFA5D9497CDBBB8AF08304F5041EAE40DA7250EB749A848F49
                                                                                                                                                        Function 00442639 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436EF2
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436F28
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044268D
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004426D7
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044279D
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoLocale$ErrorLast_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3140898709-0
                                                                                                                                                        • Opcode ID: 55da4a4ae7bafd63b20d72060ee78c72c6adc40113f74022713811abe05d4c13
                                                                                                                                                        • Instruction ID: f6a1af88ebe92fd9ab804f5d2ca75c61674f1e14574f303e165adeab49624688
                                                                                                                                                        • Opcode Fuzzy Hash: 55da4a4ae7bafd63b20d72060ee78c72c6adc40113f74022713811abe05d4c13
                                                                                                                                                        • Instruction Fuzzy Hash: 2E6183715102179BEB28AF25CE82B6A77A8FF04300F50417BF905C6685E7BCE991CB58
                                                                                                                                                        Function 004125A0 Relevance: 4.6, APIs: 3, Instructions: 104networkCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • recv.WS2_32(?,?,00000004,00000000), ref: 004125EB
                                                                                                                                                        • recv.WS2_32(?,?,00000008,00000000), ref: 00412620
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: recv
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1507349165-0
                                                                                                                                                        • Opcode ID: c4e3062267f573ee3b97dcf180196bcfcf4298404c0d69829baace39bdbdf955
                                                                                                                                                        • Instruction ID: e312491c900e56f26a5c28af674009dd824f1d151720421184b6f2b9a3f52a69
                                                                                                                                                        • Opcode Fuzzy Hash: c4e3062267f573ee3b97dcf180196bcfcf4298404c0d69829baace39bdbdf955
                                                                                                                                                        • Instruction Fuzzy Hash: F631DB719002189BD710DB68DD45BEB77ACFB08724F14022BE914E73D1DBB8AC5587A9
                                                                                                                                                        Function 00442513 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • EnumSystemLocalesW.KERNEL32(00442639,00000001,00000000,?,-00000050,?,00442C67,00000000,?,?,?,00000055,?), ref: 00442585
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                        • String ID: g,D
                                                                                                                                                        • API String ID: 2417226690-4200196752
                                                                                                                                                        • Opcode ID: edb223a2dc53ae2e7aa52fcc9057f81cd266cc95d3adf5a3811fffa08b2bde63
                                                                                                                                                        • Instruction ID: 1759c982fde48aab650fb1a178cabffca275d15816584a46cefa57d6f8a024d7
                                                                                                                                                        • Opcode Fuzzy Hash: edb223a2dc53ae2e7aa52fcc9057f81cd266cc95d3adf5a3811fffa08b2bde63
                                                                                                                                                        • Instruction Fuzzy Hash: 5411293A200701AFEB189F79C9A167BB791FF84359B55482EF54687B40D3B5B902CB44
                                                                                                                                                        Function 0044288C Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436EF2
                                                                                                                                                          • Part of subcall function 00436E90: _free.LIBCMT ref: 00436F28
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004428E0
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast_free$InfoLocale
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2003897158-0
                                                                                                                                                        • Opcode ID: bd75f248c0f74e2c2b50dd9c6c7715b841a90fd8aa4e2ff9220b10beb98af2bb
                                                                                                                                                        • Instruction ID: a93128899983090ebd5a3946295c461b74d0afd1286e07689356aae3fa853648
                                                                                                                                                        • Opcode Fuzzy Hash: bd75f248c0f74e2c2b50dd9c6c7715b841a90fd8aa4e2ff9220b10beb98af2bb
                                                                                                                                                        • Instruction Fuzzy Hash: B221A4B1714206ABEB289F25DD42ABB77A8EF04314F50007FF901D6251EAB8ED408B58
                                                                                                                                                        Function 00442AB8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00442855,00000000,00000000,?), ref: 00442AE4
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$InfoLocale
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3736152602-0
                                                                                                                                                        • Opcode ID: b85d983ab81ba2d72f2879a9f8eec96c0e664ac1e840e02836baff99c00c8b4e
                                                                                                                                                        • Instruction ID: 928d0b03c839d1e8b54bbcfff585bb49a61326c14d016b70883a732459a475e2
                                                                                                                                                        • Opcode Fuzzy Hash: b85d983ab81ba2d72f2879a9f8eec96c0e664ac1e840e02836baff99c00c8b4e
                                                                                                                                                        • Instruction Fuzzy Hash: D6F0FE366002117BEB245E21C949BBB7754EB40354F45482AFC02F3240DAB8FD01C6E4
                                                                                                                                                        Function 004425AE Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • EnumSystemLocalesW.KERNEL32(0044288C,00000001,00000000,?,-00000050,?,00442C2B,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004425F8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2417226690-0
                                                                                                                                                        • Opcode ID: 9963e7c7bf08e2960c297677dca5ed1a360fe990d6ac1b9052d2404969058c84
                                                                                                                                                        • Instruction ID: b1bc05781dcf2dde9bf24d6b332180b5e8a1d39f8b681405863e2b141d005b3c
                                                                                                                                                        • Opcode Fuzzy Hash: 9963e7c7bf08e2960c297677dca5ed1a360fe990d6ac1b9052d2404969058c84
                                                                                                                                                        • Instruction Fuzzy Hash: 5FF0F6362003046FEB149F36DD85A7B7BD1EF80368F56442EF9058B690D6B9AC01DB58
                                                                                                                                                        Function 0043857F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00432770: EnterCriticalSection.KERNEL32(-00038111,?,00433A97,00000000,00464020,0000000C,00433A5E,?,?,0043A8C0,?,?,00437032), ref: 0043277F
                                                                                                                                                        • EnumSystemLocalesW.KERNEL32(00438572,00000001,00464240,0000000C,0043899D,00000000), ref: 004385B7
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1272433827-0
                                                                                                                                                        • Opcode ID: 364984b5207ae80d4e0567423da60e5aacc3218f5514e642189a1cadc12b6449
                                                                                                                                                        • Instruction ID: 5780594316d2a6a1687bef7b39e7fa1bc03f2b733c4e38d07d259e9cae459532
                                                                                                                                                        • Opcode Fuzzy Hash: 364984b5207ae80d4e0567423da60e5aacc3218f5514e642189a1cadc12b6449
                                                                                                                                                        • Instruction Fuzzy Hash: 21F03C72A00310AFD700DF99E842B9D77E0EB09765F10406EF401D72A1DBB999448F49
                                                                                                                                                        Function 004424C8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • EnumSystemLocalesW.KERNEL32(00442421,00000001,00000000,?,?,00442C89,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 004424FF
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2417226690-0
                                                                                                                                                        • Opcode ID: 970254bb37c95fb92da55e9e528d57c0668c4cf86a347a729a501bfca270248b
                                                                                                                                                        • Instruction ID: 6bf45375f0f4cacb8072a20724b784c7b81256eef896ff89ab6a53b2a8fb59c5
                                                                                                                                                        • Opcode Fuzzy Hash: 970254bb37c95fb92da55e9e528d57c0668c4cf86a347a729a501bfca270248b
                                                                                                                                                        • Instruction Fuzzy Hash: 50F0553A30020567DB04AF76D80576BBF90EFC1750B47405EFE098B251C6B9D842C794
                                                                                                                                                        Function 00438AA1 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00435DF4,?,20001004,00000000,00000002,?,?,00435401), ref: 00438AD5
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InfoLocale
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2299586839-0
                                                                                                                                                        • Opcode ID: d118b150fa3826a1bdc34cf50bb8c0874879c2cebce0eb20d34dad6a2d49df20
                                                                                                                                                        • Instruction ID: a7e265e5936165e441dd6c05b68bc65ed7e740ee4e759337bd82b0c0c3140a44
                                                                                                                                                        • Opcode Fuzzy Hash: d118b150fa3826a1bdc34cf50bb8c0874879c2cebce0eb20d34dad6a2d49df20
                                                                                                                                                        • Instruction Fuzzy Hash: E2E0D831100318BBCF122F61DC14B9EBF19EF48751F00841AFD0551261CF798C219A9C
                                                                                                                                                        Function 0042974D Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 192 42974d-429a06 GetModuleHandleW GetProcAddress * 40
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00429753
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00429761
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00429772
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00429783
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00429794
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004297A5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 004297B6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004297C7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 004297D8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004297E9
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 004297FA
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0042980B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0042981C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0042982D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0042983E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0042984F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00429860
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00429871
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00429882
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00429893
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 004298A4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004298B5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 004298C6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 004298D7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 004298E8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004298F9
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0042990A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0042991B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0042992C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0042993D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0042994E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0042995F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00429970
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00429981
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00429992
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 004299A3
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 004299B4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 004299C5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 004299D6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 004299E7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 004299F8
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                        • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                                                                                        • API String ID: 667068680-295688737
                                                                                                                                                        • Opcode ID: 63d7673f4d88576647c96e3569174ee16801f2e420e8604d091896ebc7034ee5
                                                                                                                                                        • Instruction ID: 0b95901f21e3754b8ec5c880fcdf8e007699ecfcb2ee853bd5e906210ff8deb9
                                                                                                                                                        • Opcode Fuzzy Hash: 63d7673f4d88576647c96e3569174ee16801f2e420e8604d091896ebc7034ee5
                                                                                                                                                        • Instruction Fuzzy Hash: D0612A71995350BBCB405FB4EE0DB863BA8AA1AB07310453BF601D25B3EBF998448B5D
                                                                                                                                                        Function 00408280 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 257pipeprocessfileCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        APIs
                                                                                                                                                        • GetTempPathA.KERNEL32(00000080,?), ref: 0040832D
                                                                                                                                                        • CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00408403
                                                                                                                                                        • SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00408415
                                                                                                                                                        • Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00408459
                                                                                                                                                        • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00408481
                                                                                                                                                        • Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0040848F
                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064), ref: 004084B8
                                                                                                                                                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004084DA
                                                                                                                                                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004084FE
                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,0000007F,00000000,00000000), ref: 00408525
                                                                                                                                                        • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040856A
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00408581
                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00408589
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00408591
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00408599
                                                                                                                                                        • GetLastError.KERNEL32 ref: 004085A3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Handle$ClosePipeWow64$NamedPeek$CreateRedirection$DisableErrorFileInformationLastObjectPathProcessReadRevertSingleTempWait
                                                                                                                                                        • String ID: D
                                                                                                                                                        • API String ID: 3215130363-2746444292
                                                                                                                                                        • Opcode ID: 84639b4b597932abaa2052d578161269dd35b10cc4b40dd713f5572b8e63c254
                                                                                                                                                        • Instruction ID: d63ba59e0875ed272714b05d1e849e547cd3f502839bebfc8c32bcfd79e4a118
                                                                                                                                                        • Opcode Fuzzy Hash: 84639b4b597932abaa2052d578161269dd35b10cc4b40dd713f5572b8e63c254
                                                                                                                                                        • Instruction Fuzzy Hash: E6A18471940228ABEB20DF20DD45FDDB778AF44704F1041EAEA08B62D1DB79AE84CF59
                                                                                                                                                        Function 0044018F Relevance: 25.9, APIs: 17, Instructions: 411COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1156 44018f-44019d 1157 4401b2-4401c5 call 4485f0 1156->1157 1158 44019f-4401ad call 4312e2 1156->1158 1163 4403a6-4403ab call 4312e2 1157->1163 1164 4401cb-4401cd 1157->1164 1165 4403bf-4403c1 1158->1165 1171 4403b1 1163->1171 1164->1163 1166 4401d3-4401e6 call 44078e 1164->1166 1172 440263-44026d 1166->1172 1173 4401e8-4401eb 1166->1173 1174 4403b4-4403be call 438279 1171->1174 1172->1171 1177 440273-440289 call 4407c2 1172->1177 1175 4401ed-4401f3 1173->1175 1176 440209-44020c 1173->1176 1174->1165 1175->1176 1179 4401f5-4401fc call 43439c 1175->1179 1181 440215-440232 call 43a88d call 438279 1176->1181 1182 44020e-440210 1176->1182 1189 4402da-4402dd 1177->1189 1190 44028b-44028d 1177->1190 1179->1163 1193 440202-440207 call 44078e 1179->1193 1181->1171 1201 440238-44023e 1181->1201 1182->1174 1189->1174 1194 4402e3-4402ed 1189->1194 1190->1189 1191 44028f-44029e call 438279 1190->1191 1204 4402d0-4402d8 1191->1204 1205 4402a0-4402a3 1191->1205 1193->1172 1194->1171 1198 4402f3-4402f9 1194->1198 1198->1171 1199 4402ff-440319 call 440885 call 438279 1198->1199 1199->1171 1220 44031f-440327 1199->1220 1201->1172 1206 440240-44025d call 43a88d call 438279 1201->1206 1210 440330-440333 1204->1210 1208 4402ad-4402b0 1205->1208 1206->1171 1206->1172 1212 4402a5-4402ac 1208->1212 1213 4402b2-4402cc call 440885 call 438279 1208->1213 1210->1174 1215 440335 1210->1215 1212->1208 1213->1210 1229 4402ce 1213->1229 1219 440338-44033d 1215->1219 1219->1219 1223 44033f-440355 call 43a88d 1219->1223 1224 44032b 1220->1224 1230 440357-440368 call 4362a2 1223->1230 1231 44039d-4403a4 call 438279 1223->1231 1224->1210 1229->1224 1236 4403c2 1230->1236 1237 44036a-44038d call 446fb1 1230->1237 1231->1174 1239 4403c7 call 42f0c2 1236->1239 1237->1231 1242 44038f-440397 call 4312e2 1237->1242 1241 4403cc-4403db 1239->1241 1243 4403f0-440403 call 44871b 1241->1243 1244 4403dd-4403eb call 4312e2 1241->1244 1242->1231 1252 4405f9-4405fe call 4312e2 1243->1252 1253 440409-44040b 1243->1253 1251 440612-440614 1244->1251 1258 440604 1252->1258 1253->1252 1255 440411-44042c call 4407a8 1253->1255 1261 4404b7-4404d1 call 440817 1255->1261 1262 440432-44043a 1255->1262 1260 440607-440611 call 438279 1258->1260 1260->1251 1273 4404d3-4404d5 1261->1273 1274 44051f-440523 1261->1274 1265 440454-440458 1262->1265 1266 44043c-44043e 1262->1266 1270 440461-440463 1265->1270 1271 44045a-44045c 1265->1271 1266->1265 1267 440440-440447 call 4343a1 1266->1267 1267->1252 1283 44044d-440452 call 4407a8 1267->1283 1275 440465-440482 call 43a88d call 438279 1270->1275 1276 440492-4404a6 call 43a88d call 438279 1270->1276 1271->1260 1273->1274 1280 4404d7-4404e7 call 438279 1273->1280 1274->1260 1279 440529-440533 1274->1279 1275->1258 1301 440488-440490 1275->1301 1298 4404a9-4404b1 1276->1298 1279->1258 1284 440539-44053f 1279->1284 1295 4404fe-440501 1280->1295 1296 4404e9-4404f1 1280->1296 1283->1298 1284->1258 1289 440545-44055b call 440885 call 438279 1284->1289 1289->1258 1312 440561-44056c 1289->1312 1302 4404f6-4404fd 1295->1302 1303 440503-44051b call 440885 call 438279 1295->1303 1300 440576-440579 1296->1300 1298->1258 1298->1261 1300->1260 1304 44057f-440581 1300->1304 1301->1261 1301->1276 1302->1295 1303->1300 1317 44051d 1303->1317 1307 440584-44058d 1304->1307 1307->1307 1310 44058f-4405a7 call 43a88d 1307->1310 1318 4405f0-4405f7 call 438279 1310->1318 1319 4405a9-4405bb call 43c766 1310->1319 1315 440570 1312->1315 1315->1300 1317->1315 1318->1260 1324 440615 1319->1324 1325 4405bd-4405e0 SetEnvironmentVariableW 1319->1325 1326 44061a call 42f0c2 1324->1326 1325->1318 1327 4405e2-4405ea call 4312e2 1325->1327 1328 44061f 1326->1328 1327->1318
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$___from_strstr_to_strchr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3409252457-0
                                                                                                                                                        • Opcode ID: d0c5795adac76df5403975cb9ad8066c6981fde031a50dc890d9d150f5bec10f
                                                                                                                                                        • Instruction ID: 97b891390cb6a7acfff14742c4279d3667352284b1a355410f90726b38620604
                                                                                                                                                        • Opcode Fuzzy Hash: d0c5795adac76df5403975cb9ad8066c6981fde031a50dc890d9d150f5bec10f
                                                                                                                                                        • Instruction Fuzzy Hash: 42D1DB71900301AFEB24AFA6C84196F77A8AF05314F14416FFB0197282EB7D9D51CB5D
                                                                                                                                                        Function 00432AE3 Relevance: 22.9, APIs: 15, Instructions: 357COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$Info
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2509303402-0
                                                                                                                                                        • Opcode ID: 229f0d185bc4384e52d1ff0b66255b6140caf7ed04e40224d04d270c9caa15d5
                                                                                                                                                        • Instruction ID: 7fc8dd06c27c6911c9186ff8689f55079aebce6685a9e1e96e0e2bedcd7a02d9
                                                                                                                                                        • Opcode Fuzzy Hash: 229f0d185bc4384e52d1ff0b66255b6140caf7ed04e40224d04d270c9caa15d5
                                                                                                                                                        • Instruction Fuzzy Hash: 05D19D719003059FDB119FAAC982BAEBBB4BF0C304F14516EF495A7242DBB9A845CB64
                                                                                                                                                        Function 00429D5A Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(00468FA8,00000FA0,?,?,00429D38), ref: 00429D66
                                                                                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00429D38), ref: 00429D71
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00429D38), ref: 00429D82
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00429D94
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00429DA2
                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00429D38), ref: 00429DC5
                                                                                                                                                        • DeleteCriticalSection.KERNEL32(00468FA8,00000007,?,?,00429D38), ref: 00429DE1
                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00429D38), ref: 00429DF1
                                                                                                                                                        Strings
                                                                                                                                                        • kernel32.dll, xrefs: 00429D7D
                                                                                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00429D6C
                                                                                                                                                        • WakeAllConditionVariable, xrefs: 00429D9A
                                                                                                                                                        • SleepConditionVariableCS, xrefs: 00429D8E
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                        • API String ID: 2565136772-3242537097
                                                                                                                                                        • Opcode ID: 8e48d6b5a75efb31d6c849a589e02d6cf0ca6d8e34eb5bef077a5a9f7027a2db
                                                                                                                                                        • Instruction ID: 5a12e35aea90f3dcd84591914ae06bc795863caca97bf1134a19f09b27c96de9
                                                                                                                                                        • Opcode Fuzzy Hash: 8e48d6b5a75efb31d6c849a589e02d6cf0ca6d8e34eb5bef077a5a9f7027a2db
                                                                                                                                                        • Instruction Fuzzy Hash: 63019271791361ABD7241B74BD09B9B3699AB51B52F10017AFC04E32A1EFE8CC00867E
                                                                                                                                                        Function 0044180D Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___free_lconv_mon.LIBCMT ref: 00441851
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B24
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B36
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B48
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B5A
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B6C
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B7E
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440B90
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BA2
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BB4
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BC6
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BD8
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BEA
                                                                                                                                                          • Part of subcall function 00440B07: _free.LIBCMT ref: 00440BFC
                                                                                                                                                        • _free.LIBCMT ref: 00441846
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 00441868
                                                                                                                                                        • _free.LIBCMT ref: 0044187D
                                                                                                                                                        • _free.LIBCMT ref: 00441888
                                                                                                                                                        • _free.LIBCMT ref: 004418AA
                                                                                                                                                        • _free.LIBCMT ref: 004418BD
                                                                                                                                                        • _free.LIBCMT ref: 004418CB
                                                                                                                                                        • _free.LIBCMT ref: 004418D6
                                                                                                                                                        • _free.LIBCMT ref: 0044190E
                                                                                                                                                        • _free.LIBCMT ref: 00441915
                                                                                                                                                        • _free.LIBCMT ref: 00441932
                                                                                                                                                        • _free.LIBCMT ref: 0044194A
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 161543041-0
                                                                                                                                                        • Opcode ID: ae52e7fce0134140acc547cdcdbe20a26bdf9873947ab1665f4141750425fcc1
                                                                                                                                                        • Instruction ID: 059532a64598d5090ae23d4405580a6bbfbe5189039f758bd88993e58f5adf95
                                                                                                                                                        • Opcode Fuzzy Hash: ae52e7fce0134140acc547cdcdbe20a26bdf9873947ab1665f4141750425fcc1
                                                                                                                                                        • Instruction Fuzzy Hash: 0D314771600B05AEEB20AA7BD805B57B3E9AF04354F10446FF459D62A2DF7CACC0CB28
                                                                                                                                                        Function 00440C05 Relevance: 18.4, APIs: 12, Instructions: 373COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 269201875-0
                                                                                                                                                        • Opcode ID: e8e502443f981a65d4dee212598e1ba74a34f463f93ce5860ea95c526d30a543
                                                                                                                                                        • Instruction ID: 3583ac8ead52736eab34d27870fe1a6f4e30558d67da8e2645d638687aab42ec
                                                                                                                                                        • Opcode Fuzzy Hash: e8e502443f981a65d4dee212598e1ba74a34f463f93ce5860ea95c526d30a543
                                                                                                                                                        • Instruction Fuzzy Hash: 90C12572D40304AFEB60DBA9CC82FDFB7F89B08704F14456AFA05FB282D67899518764
                                                                                                                                                        Function 0043B62A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 0-3907804496
                                                                                                                                                        • Opcode ID: 3dd2c51e623567fd1949e9cbb56891fb850c907afc17de8b0c2f61a953d47db7
                                                                                                                                                        • Instruction ID: fd16f405f807b752fcef56a435d82f234f34e331ed8d779e459907ebde6df466
                                                                                                                                                        • Opcode Fuzzy Hash: 3dd2c51e623567fd1949e9cbb56891fb850c907afc17de8b0c2f61a953d47db7
                                                                                                                                                        • Instruction Fuzzy Hash: 82C1E4B0A043059FCB15DF99C881BAE7BB5FF4D304F10505AE645AB3A2C7789D41CBA9
                                                                                                                                                        Function 00443B9F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00443858: CreateFileW.KERNEL32(00000000,?,?,H<D,?,?,00000000,?,00443C48,00000000,0000000C), ref: 00443875
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00443CB3
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00443CBA
                                                                                                                                                        • GetFileType.KERNEL32(00000000), ref: 00443CC6
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00443CD0
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00443CD9
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00443CF9
                                                                                                                                                        • CloseHandle.KERNEL32(004374B1), ref: 00443E46
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00443E78
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00443E7F
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                        • String ID: H
                                                                                                                                                        • API String ID: 4237864984-2852464175
                                                                                                                                                        • Opcode ID: fc4dbe16e554381112ec6a6c4fe311805bfa2ed859929065e350e039b43688f2
                                                                                                                                                        • Instruction ID: 9552d957c28b47feb4ac3819d9276cbe8a438e1b0a5642b03032edaa49475a4b
                                                                                                                                                        • Opcode Fuzzy Hash: fc4dbe16e554381112ec6a6c4fe311805bfa2ed859929065e350e039b43688f2
                                                                                                                                                        • Instruction Fuzzy Hash: 4FA14932A041449FDF199F68DC417AE7BA0EB0A725F14015EF811EB3E1D7789E12C75A
                                                                                                                                                        Function 004290E3 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 139threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
                                                                                                                                                        • String ID: /@
                                                                                                                                                        • API String ID: 3943753294-2163338593
                                                                                                                                                        • Opcode ID: 32c6520eb408b0b7023a1b4e99d757177a819bec6b9d07bf3c0f193e4cf47272
                                                                                                                                                        • Instruction ID: b6cb2b2ad1f672c59e77c9313722094597ecfd5328d6b6fcb5977fc2610eb25b
                                                                                                                                                        • Opcode Fuzzy Hash: 32c6520eb408b0b7023a1b4e99d757177a819bec6b9d07bf3c0f193e4cf47272
                                                                                                                                                        • Instruction Fuzzy Hash: 17519231B00226DFDF10DF65E9899AAB7B4FF08351F9544ABE806AB251C734ED40CB69
                                                                                                                                                        Function 00422AD0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 343COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$Cnd_broadcast
                                                                                                                                                        • String ID: `aB
                                                                                                                                                        • API String ID: 3990724213-1403152488
                                                                                                                                                        • Opcode ID: e78533e7b606a0909dfcd03366121f13470cb03426e61e0b551c0070bbbb0ba1
                                                                                                                                                        • Instruction ID: ff1e1b2dd1a98a01de7ce247edd392ed6bd3e8a22f1de7711d4d55fede56ff5a
                                                                                                                                                        • Opcode Fuzzy Hash: e78533e7b606a0909dfcd03366121f13470cb03426e61e0b551c0070bbbb0ba1
                                                                                                                                                        • Instruction Fuzzy Hash: E6B13871E00215AFDB20DF65E945BAFBBB4BF05304F40452FE81657392DB78A904CB9A
                                                                                                                                                        Function 0042D082 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 0042D17F
                                                                                                                                                        • type_info::operator==.LIBVCRUNTIME ref: 0042D1A1
                                                                                                                                                        • ___TypeMatch.LIBVCRUNTIME ref: 0042D2B0
                                                                                                                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 0042D382
                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 0042D406
                                                                                                                                                        • CallUnexpected.LIBVCRUNTIME ref: 0042D421
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                        • API String ID: 2123188842-393685449
                                                                                                                                                        • Opcode ID: c2eea119acf5c0d3e2a133d299b240dfa57c6749be22527b7d92e0dbe9d40283
                                                                                                                                                        • Instruction ID: 3020726618cbdd44f6bbf4d09117d55b9bb00335d87340c061789c8061bee125
                                                                                                                                                        • Opcode Fuzzy Hash: c2eea119acf5c0d3e2a133d299b240dfa57c6749be22527b7d92e0dbe9d40283
                                                                                                                                                        • Instruction Fuzzy Hash: DBB19D71E00229DFCF18DFA5E9819AEBBB5FF04314F90405BE8116B211D739DA51CB9A
                                                                                                                                                        Function 00436D78 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00436D8E
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 00436D9A
                                                                                                                                                        • _free.LIBCMT ref: 00436DA5
                                                                                                                                                        • _free.LIBCMT ref: 00436DB0
                                                                                                                                                        • _free.LIBCMT ref: 00436DBB
                                                                                                                                                        • _free.LIBCMT ref: 00436DC6
                                                                                                                                                        • _free.LIBCMT ref: 00436DD1
                                                                                                                                                        • _free.LIBCMT ref: 00436DDC
                                                                                                                                                        • _free.LIBCMT ref: 00436DE7
                                                                                                                                                        • _free.LIBCMT ref: 00436DF5
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: d305eb2f78d132329aa3d529ae08fdf1df956d88b21b94e35fbfa51ff169c1e5
                                                                                                                                                        • Instruction ID: 4a9259cf065dbc7d3097c3e9443b184da848faa336d483787df0d98d3508c38f
                                                                                                                                                        • Opcode Fuzzy Hash: d305eb2f78d132329aa3d529ae08fdf1df956d88b21b94e35fbfa51ff169c1e5
                                                                                                                                                        • Instruction Fuzzy Hash: EB217776900208EFCF41EFD7D845DDE7BB5AF08344F0191ABB5159B122DA39EA948B84
                                                                                                                                                        Function 004462EB Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00447F5F), ref: 00446304
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: DecodePointer
                                                                                                                                                        • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                                                                                        • API String ID: 3527080286-3064271455
                                                                                                                                                        • Opcode ID: 5a7a1f50d9d0dcb991c3fb77137ce8ed0aca6e216fffb4eae18881fd9764d9a4
                                                                                                                                                        • Instruction ID: 0287f1b31b313a413d7a1f0399663d431f045d13871e987e7617b1471f81b525
                                                                                                                                                        • Opcode Fuzzy Hash: 5a7a1f50d9d0dcb991c3fb77137ce8ed0aca6e216fffb4eae18881fd9764d9a4
                                                                                                                                                        • Instruction Fuzzy Hash: 64518C7090051ACBEF108FA8D94C1BEBB74FB46305F528197D881A6264CBBC8929CB5F
                                                                                                                                                        Function 00404910 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 0040499F
                                                                                                                                                          • Part of subcall function 0042B3B6: RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise___std_exception_copy
                                                                                                                                                        • String ID: 0*@$0*@$0EF$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$$@
                                                                                                                                                        • API String ID: 3109751735-2441489948
                                                                                                                                                        • Opcode ID: 0109241253719047a6d74d06e0e93c3d41252864365afcee4fc758db8782bd0f
                                                                                                                                                        • Instruction ID: 9069301fae2975c4eab8c0d1914a0b8b38638952c4c5906a87ad0c487cecbeb6
                                                                                                                                                        • Opcode Fuzzy Hash: 0109241253719047a6d74d06e0e93c3d41252864365afcee4fc758db8782bd0f
                                                                                                                                                        • Instruction Fuzzy Hash: A711DFF26007046BC700DA69D842B96B3E8EB91311F14C53BBE55976C2E778A914CBA9
                                                                                                                                                        Function 00441024 Relevance: 13.7, APIs: 9, Instructions: 199COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 269201875-0
                                                                                                                                                        • Opcode ID: 41e98232c88f3691606d4a032a760ccc22e9ed94f37c3f7db9ec4dac68a01374
                                                                                                                                                        • Instruction ID: 2ae5536e30cb0381351a7e8f15e3d99bde6e14b0c3d459ede7b960827d913732
                                                                                                                                                        • Opcode Fuzzy Hash: 41e98232c88f3691606d4a032a760ccc22e9ed94f37c3f7db9ec4dac68a01374
                                                                                                                                                        • Instruction Fuzzy Hash: 4E61E371900705AFEB20DF76C881BABB7E8EB48310F10456FF955EB291EB789D808B54
                                                                                                                                                        Function 00429B36 Relevance: 12.2, APIs: 8, Instructions: 175COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00429B7F
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 00429BAB
                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00429BEA
                                                                                                                                                        • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00429C07
                                                                                                                                                        • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00429C46
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 00429C63
                                                                                                                                                        • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00429CA5
                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00429CC8
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiStringWide$__alloca_probe_16
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2040435927-0
                                                                                                                                                        • Opcode ID: ffe1be3034fff07c44cab7664f690817caf88de5f9afa902797cde9abb390132
                                                                                                                                                        • Instruction ID: 586ae39429e32a5882ee8ae18348ddbb7c8fd11ea008a38feeac80361965ecbd
                                                                                                                                                        • Opcode Fuzzy Hash: ffe1be3034fff07c44cab7664f690817caf88de5f9afa902797cde9abb390132
                                                                                                                                                        • Instruction Fuzzy Hash: 1051AF7260022AABEF209F52EC45FAB7BE9FF44754F54402AF815E6250D738DC10CB68
                                                                                                                                                        Function 00435A32 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • _free.LIBCMT ref: 00435D1D
                                                                                                                                                        • _free.LIBCMT ref: 00435D36
                                                                                                                                                        • _free.LIBCMT ref: 00435D74
                                                                                                                                                        • _free.LIBCMT ref: 00435D7D
                                                                                                                                                        • _free.LIBCMT ref: 00435D89
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorLast
                                                                                                                                                        • String ID: C
                                                                                                                                                        • API String ID: 3291180501-1037565863
                                                                                                                                                        • Opcode ID: 9ef99747f9037a3f98bf733f0ed22c7ffcfadf3b777ae6ddcc736cff8f92ff25
                                                                                                                                                        • Instruction ID: bf18d6ad4f558da28f08027fa38d354fd6e3d3bc69d28bf8e2af5a501f3cd5ce
                                                                                                                                                        • Opcode Fuzzy Hash: 9ef99747f9037a3f98bf733f0ed22c7ffcfadf3b777ae6ddcc736cff8f92ff25
                                                                                                                                                        • Instruction Fuzzy Hash: 4FB16C759017199FDB24DF19C888AAEB3B4FF48308F5055AEE809A7351E734AE90CF44
                                                                                                                                                        Function 004355A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 004384A8: HeapAlloc.KERNEL32(00000000,?,?,?,0043FC50,00000220,?,?,?,?,?,?,0042F14E,?), ref: 004384DA
                                                                                                                                                        • _free.LIBCMT ref: 004356B6
                                                                                                                                                        • _free.LIBCMT ref: 004356CD
                                                                                                                                                        • _free.LIBCMT ref: 004356EA
                                                                                                                                                        • _free.LIBCMT ref: 00435705
                                                                                                                                                        • _free.LIBCMT ref: 0043571C
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$AllocHeap
                                                                                                                                                        • String ID: $NE
                                                                                                                                                        • API String ID: 1835388192-2823413946
                                                                                                                                                        • Opcode ID: 71337688d697aa474ba39f30650b7d541d56b2a90450a5bcaf4100324e5b84e0
                                                                                                                                                        • Instruction ID: 546c6697753df32557ddbddb8dbd850881ce61b2db840900239a2e88ae64b109
                                                                                                                                                        • Opcode Fuzzy Hash: 71337688d697aa474ba39f30650b7d541d56b2a90450a5bcaf4100324e5b84e0
                                                                                                                                                        • Instruction Fuzzy Hash: 9551D031A00B049FDB219F6AD882A6BB7F4EF5C724F54156EE809DB251E738DA418B48
                                                                                                                                                        Function 00427470 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
                                                                                                                                                        • String ID: `cB
                                                                                                                                                        • API String ID: 3354401312-1637092074
                                                                                                                                                        • Opcode ID: 2ffe0209e6ec834a4bf081228b46bf415e7d8ffdaf4dee744f5d3dd11ca3c207
                                                                                                                                                        • Instruction ID: ac4f8d138fa133061aa833817b076b5d87cd93b2fd1606e549b7e8b0709993c6
                                                                                                                                                        • Opcode Fuzzy Hash: 2ffe0209e6ec834a4bf081228b46bf415e7d8ffdaf4dee744f5d3dd11ca3c207
                                                                                                                                                        • Instruction Fuzzy Hash: 4061AD70E01229DFDB10DFA5D544BAEBBB8BF04314F54416EE805A7342DB38AA45CFA9
                                                                                                                                                        Function 004120F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: list too long
                                                                                                                                                        • API String ID: 0-1124181908
                                                                                                                                                        • Opcode ID: 5e0f34d189b62fcc3cf8b7e6dec22029d8cf39e551a0d2b838ef7c780aa47f41
                                                                                                                                                        • Instruction ID: ec5b6c1db21db62b0d107a9d3825d01e915ba95be391be28f32d7488b1d85151
                                                                                                                                                        • Opcode Fuzzy Hash: 5e0f34d189b62fcc3cf8b7e6dec22029d8cf39e551a0d2b838ef7c780aa47f41
                                                                                                                                                        • Instruction Fuzzy Hash: 9351B2B0D043199BDB10DF54DD45B9AF7B4FF04304F1042AAE90897381EB78AA91CB9A
                                                                                                                                                        Function 00426180 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __Mtx_unlock.LIBCPMT ref: 00426257
                                                                                                                                                        • std::_Rethrow_future_exception.LIBCPMT ref: 004262A9
                                                                                                                                                        • std::_Rethrow_future_exception.LIBCPMT ref: 004262B9
                                                                                                                                                          • Part of subcall function 00403A60: __Mtx_unlock.LIBCPMT ref: 00403B54
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Mtx_unlockRethrow_future_exceptionstd::_
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 3298230783-431066289
                                                                                                                                                        • Opcode ID: b30651e0761f0e9ad3e8f29b30edf1bd0b0f34b740de1e09294c6221c768bdd6
                                                                                                                                                        • Instruction ID: aaacaff85643f411d4512a9246ddc2eb5ef46a7b1fa254c9d620033a1334be30
                                                                                                                                                        • Opcode Fuzzy Hash: b30651e0761f0e9ad3e8f29b30edf1bd0b0f34b740de1e09294c6221c768bdd6
                                                                                                                                                        • Instruction Fuzzy Hash: 49415B71E002189BCB14EBA5EC41BAFBBB89F05304F40456FE54263682EB386944C7BA
                                                                                                                                                        Function 0042CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0042CB87
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 0042CB8F
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0042CC18
                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 0042CC43
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0042CC98
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                        • String ID: csm
                                                                                                                                                        • API String ID: 1170836740-1018135373
                                                                                                                                                        • Opcode ID: e7b3df09d7a10c5e7891cee4c4d896d8d761d9a625353f9d609074bcca53e697
                                                                                                                                                        • Instruction ID: 59089456ca2695fb9dc8a61b3260b7257c472234a28163d2da82de90e6eeb240
                                                                                                                                                        • Opcode Fuzzy Hash: e7b3df09d7a10c5e7891cee4c4d896d8d761d9a625353f9d609074bcca53e697
                                                                                                                                                        • Instruction Fuzzy Hash: 2A41B734B002249BCF10DF6AE8C5A9EBFB5AF45324F54805BE8186B352D779E901CB95
                                                                                                                                                        Function 00425270 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 004252A6
                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 004252C6
                                                                                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 004252E6
                                                                                                                                                        • std::_Facet_Register.LIBCPMT ref: 00425381
                                                                                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00425399
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                        • String ID: yAB
                                                                                                                                                        • API String ID: 459529453-3587298357
                                                                                                                                                        • Opcode ID: 93a698dea28e097ab119d0d880fe20d93c5f8692c42930c7be62979f592e2e25
                                                                                                                                                        • Instruction ID: 76ecd6f62752a2ff21f978b1b0b7a6198d3a2ab19826c43eabe59a0207e09709
                                                                                                                                                        • Opcode Fuzzy Hash: 93a698dea28e097ab119d0d880fe20d93c5f8692c42930c7be62979f592e2e25
                                                                                                                                                        • Instruction Fuzzy Hash: 7341D3B1A00624CBCB14DF55E881BAEB7B4EB04754F94416FD8066B391EBB8AD01CBD9
                                                                                                                                                        Function 004414E6 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00441232: _free.LIBCMT ref: 00441257
                                                                                                                                                        • _free.LIBCMT ref: 00441534
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 0044153F
                                                                                                                                                        • _free.LIBCMT ref: 0044154A
                                                                                                                                                        • _free.LIBCMT ref: 0044159E
                                                                                                                                                        • _free.LIBCMT ref: 004415A9
                                                                                                                                                        • _free.LIBCMT ref: 004415B4
                                                                                                                                                        • _free.LIBCMT ref: 004415BF
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: abbf06782d2151277ef86c742c26406c39e67a21eafa21519947c3b4b75dadf7
                                                                                                                                                        • Instruction ID: 640bb7207323e0c96c1002e22fbf9e8c89b76f7d322332e94dedb81a98be0554
                                                                                                                                                        • Opcode Fuzzy Hash: abbf06782d2151277ef86c742c26406c39e67a21eafa21519947c3b4b75dadf7
                                                                                                                                                        • Instruction Fuzzy Hash: D5116031581B08BAE920BB73CC07FCBB79C6F04704F404C5EB29AE6062DEBCB9454659
                                                                                                                                                        Function 0043782F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00437877
                                                                                                                                                        • __fassign.LIBCMT ref: 00437A5C
                                                                                                                                                        • __fassign.LIBCMT ref: 00437A79
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00437AC1
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00437B01
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00437BA9
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileWrite__fassign$ConsoleErrorLastOutput
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1735259414-0
                                                                                                                                                        • Opcode ID: d170db5ea5b89681c6030d8a5382554d4dbe595ccb1604b472439aef9d82a15f
                                                                                                                                                        • Instruction ID: 6cb7a689f5d526c54cac3dd9099799f5db7a3a42d5fa574cc40aeb256f4d063d
                                                                                                                                                        • Opcode Fuzzy Hash: d170db5ea5b89681c6030d8a5382554d4dbe595ccb1604b472439aef9d82a15f
                                                                                                                                                        • Instruction Fuzzy Hash: E4C183B1D042589FCB24CFA8C8809EDFBB5EF08318F28516AE895B7351D635AD46CF64
                                                                                                                                                        Function 00424AE0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00424B15
                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00424B37
                                                                                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00424B57
                                                                                                                                                        • __Getctype.LIBCPMT ref: 00424BED
                                                                                                                                                        • std::_Facet_Register.LIBCPMT ref: 00424C0C
                                                                                                                                                        • std::_Lockit::~_Lockit.LIBCPMT ref: 00424C24
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1102183713-0
                                                                                                                                                        • Opcode ID: 556c0cc3a5f117c1b49c2f8bbb2f8fe16617071d9dfb03343d44193ec2772240
                                                                                                                                                        • Instruction ID: c68eabba8c51303e45eac4acc2b9d09d7792b85252e00b8aeec26c28c43d68ba
                                                                                                                                                        • Opcode Fuzzy Hash: 556c0cc3a5f117c1b49c2f8bbb2f8fe16617071d9dfb03343d44193ec2772240
                                                                                                                                                        • Instruction Fuzzy Hash: AF41E371A002248FCB11DF54E840BAEBBB4EF94314F50416EE805AB392EB78BD01CB99
                                                                                                                                                        Function 0042CD14 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,0042CD0B,0042B3A4,004280B9,70BC39D9,?,?,?,00000000,0044CB77,000000FF,?,00402576,?,?), ref: 0042CD22
                                                                                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0042CD30
                                                                                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0042CD49
                                                                                                                                                        • SetLastError.KERNEL32(00000000,?,00000000,0044CB77,000000FF,?,00402576,?,?,?,00403BA5,00000000,?,00000000,0044C510,000000FF), ref: 0042CD9B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3852720340-0
                                                                                                                                                        • Opcode ID: e05244602e1e9cb5709058beeb82151e4566f510a6517080351c7c7d7050e3ef
                                                                                                                                                        • Instruction ID: 4f841b1dba831b8eccceb0642f65f5b24652a5863bad1277a43258e7c779400b
                                                                                                                                                        • Opcode Fuzzy Hash: e05244602e1e9cb5709058beeb82151e4566f510a6517080351c7c7d7050e3ef
                                                                                                                                                        • Instruction Fuzzy Hash: 4D01D43A3187366EA72427767CC55AF2E44EB127BA761023FF514941F2FF994C01928D
                                                                                                                                                        Function 00402810 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004029A6
                                                                                                                                                        • ___std_exception_destroy.LIBVCRUNTIME ref: 00402A40
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy___std_exception_destroy
                                                                                                                                                        • String ID: 0*@$$@$$@
                                                                                                                                                        • API String ID: 2970364248-3500887044
                                                                                                                                                        • Opcode ID: a0f173f485d37155ad6b466640120272a830ab18175ef9f2bf53fe7775f6d6f6
                                                                                                                                                        • Instruction ID: b7bc29a3929bc78268fe20e9e85fed0e6039cfee6686b76cb632eb614a0778e8
                                                                                                                                                        • Opcode Fuzzy Hash: a0f173f485d37155ad6b466640120272a830ab18175ef9f2bf53fe7775f6d6f6
                                                                                                                                                        • Instruction Fuzzy Hash: A571B271E002189BDB04DF98D985BDEFBB4EF49310F54812EE804B7386D778A954CBA9
                                                                                                                                                        Function 0043ED2F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167timeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0043EF50,?,?,00000000), ref: 0043EDA1
                                                                                                                                                        • _free.LIBCMT ref: 0043ED8F
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 0043EF59
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                        • String ID: PC$XC
                                                                                                                                                        • API String ID: 2155170405-283341404
                                                                                                                                                        • Opcode ID: 42b2a21e575063c8e3e6a62053de0b2407ee710dc51a9ff6d2f41027a296ae59
                                                                                                                                                        • Instruction ID: 69eacfedd67cda93683f03458a9322fa11d79e3bf2bca48ae2bab68835b97ec0
                                                                                                                                                        • Opcode Fuzzy Hash: 42b2a21e575063c8e3e6a62053de0b2407ee710dc51a9ff6d2f41027a296ae59
                                                                                                                                                        • Instruction Fuzzy Hash: 1B510871902225ABCB10ABA7DC06A9A7B78EF08314F10516FF414A72D1E7B89D04CB9D
                                                                                                                                                        Function 0043F747 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 0043F74C
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        • API String ID: 0-1068371695
                                                                                                                                                        • Opcode ID: ba3d7ad5631418f7358698b5625fcaa3a904080fc3b7cf54f1c00dd4c091366d
                                                                                                                                                        • Instruction ID: 7ab6651779b69a7329604debcb98eab7834f707cb1be1da5f18b3451e6b6130f
                                                                                                                                                        • Opcode Fuzzy Hash: ba3d7ad5631418f7358698b5625fcaa3a904080fc3b7cf54f1c00dd4c091366d
                                                                                                                                                        • Instruction Fuzzy Hash: 1621B071A00206BF9B24AFA68C8196B779DAB0C368F10553BF815D62A1E728DC4587A8
                                                                                                                                                        Function 0042DD67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,0042DE28,?,?,00000000,?,?,0042DEDA,00000002,FlsGetValue,004533E8,004533F0,?), ref: 0042DDF7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                        • API String ID: 3664257935-2084034818
                                                                                                                                                        • Opcode ID: 879778e7d2308195e917bbaccaeebcb4e1a652a571419d5e252b41d0156f66b6
                                                                                                                                                        • Instruction ID: 22a1bcc481d5efad704b9fb7ebaf4a10c574d5ca51c9333c3c663f2ee38b1c7c
                                                                                                                                                        • Opcode Fuzzy Hash: 879778e7d2308195e917bbaccaeebcb4e1a652a571419d5e252b41d0156f66b6
                                                                                                                                                        • Instruction Fuzzy Hash: A411E332F51B35ABCF225B68AC40B9A3394AF01761F600162FC11E73D0D678ED0086DD
                                                                                                                                                        Function 0042E202 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0042E1F7,?,?,0042E1BF,?,?,?), ref: 0042E217
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042E22A
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,0042E1F7,?,?,0042E1BF,?,?,?), ref: 0042E24D
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                        • Opcode ID: 3a1a8ca50adacdc2c7ad7c535e8dbfbc919cdf3fb32b0d6fbab2a41d565829fc
                                                                                                                                                        • Instruction ID: c295e8bc1bbb7cad634b7ea612eee35285ba02b787890d1e6dc7dd58e89dd423
                                                                                                                                                        • Opcode Fuzzy Hash: 3a1a8ca50adacdc2c7ad7c535e8dbfbc919cdf3fb32b0d6fbab2a41d565829fc
                                                                                                                                                        • Instruction Fuzzy Hash: A9F01231A01629FBDB129B51ED09B9E7AA8EB44797F1440A1F901E11A1DB74DF00DAA8
                                                                                                                                                        Function 00447A3C Relevance: 7.7, APIs: 5, Instructions: 244COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCPInfo.KERNEL32(00EAD030,00EAD030,?,7FFFFFFF,?,?,00447CF8,00EAD030,00EAD030,?,00EAD030,?,?,?,?,00EAD030), ref: 00447ADF
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 00447B95
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 00447C2B
                                                                                                                                                        • __freea.LIBCMT ref: 00447C96
                                                                                                                                                        • __freea.LIBCMT ref: 00447CA2
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __alloca_probe_16__freea$Info
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2330168043-0
                                                                                                                                                        • Opcode ID: dc519855e3166abf4f9e0cf8e285ff4c6058ad5d8e0f79acf0afa5c52c5aaa52
                                                                                                                                                        • Instruction ID: 39d59542484eb84a3aaa557b7d81ba8254cee7afd14195ef6cfa120b32ac3c55
                                                                                                                                                        • Opcode Fuzzy Hash: dc519855e3166abf4f9e0cf8e285ff4c6058ad5d8e0f79acf0afa5c52c5aaa52
                                                                                                                                                        • Instruction Fuzzy Hash: 6D81C372D08259ABEF209F658C81AEF7BB5DF09358F19045BE804B7341D739DC4287A9
                                                                                                                                                        Function 0043C533 Relevance: 7.7, APIs: 5, Instructions: 199COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 0043C5B7
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 0043C67D
                                                                                                                                                        • __freea.LIBCMT ref: 0043C6E9
                                                                                                                                                          • Part of subcall function 004384A8: HeapAlloc.KERNEL32(00000000,?,?,?,0043FC50,00000220,?,?,?,?,?,?,0042F14E,?), ref: 004384DA
                                                                                                                                                        • __freea.LIBCMT ref: 0043C6F2
                                                                                                                                                        • __freea.LIBCMT ref: 0043C715
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1096550386-0
                                                                                                                                                        • Opcode ID: da02b6ee7e5ff368d747182ed4b7df38b9c5915a50071cba704e8ab9a43cb572
                                                                                                                                                        • Instruction ID: 9b34809cbe7da2e793d7162d83548486298492188248fff0b11dd82597cd6245
                                                                                                                                                        • Opcode Fuzzy Hash: da02b6ee7e5ff368d747182ed4b7df38b9c5915a50071cba704e8ab9a43cb572
                                                                                                                                                        • Instruction Fuzzy Hash: 3251D472600216BBDB205F65CC82EBF76A9EB48754F15611FFC04F6241EB38DC109769
                                                                                                                                                        Function 0043088C Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004307BE), ref: 004308AE
                                                                                                                                                        • GetFileInformationByHandle.KERNEL32(?,?), ref: 00430908
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004307BE,?,000000FF,00000000,00000000), ref: 00430996
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0043099D
                                                                                                                                                        • PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 004309DA
                                                                                                                                                          • Part of subcall function 00430C02: __dosmaperr.LIBCMT ref: 00430C37
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1206951868-0
                                                                                                                                                        • Opcode ID: bc15cce9badd65417fa134875b7be114ca9e25a8d04049ac41a9aab4f784e933
                                                                                                                                                        • Instruction ID: 4114d3553fc9cb8aa74b24c8144645655700e080cd41aa03631c5b7052e2c34c
                                                                                                                                                        • Opcode Fuzzy Hash: bc15cce9badd65417fa134875b7be114ca9e25a8d04049ac41a9aab4f784e933
                                                                                                                                                        • Instruction Fuzzy Hash: A7414FB5900204AFDB24DFA6DC55AAFBBF9EF4C304B10962EF556D3622E7349840CB25
                                                                                                                                                        Function 00440FBB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 00440FD3
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 00440FE5
                                                                                                                                                        • _free.LIBCMT ref: 00440FF7
                                                                                                                                                        • _free.LIBCMT ref: 00441009
                                                                                                                                                        • _free.LIBCMT ref: 0044101B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: 3700b1d01d0f743a177f9bcd14190786602e042492a4215b080e5bbd353f2358
                                                                                                                                                        • Instruction ID: 00cb94877ec5cdd0baffb3063463c6d6b29a5be177e4d8090bab9d9d52bea61c
                                                                                                                                                        • Opcode Fuzzy Hash: 3700b1d01d0f743a177f9bcd14190786602e042492a4215b080e5bbd353f2358
                                                                                                                                                        • Instruction Fuzzy Hash: FEF0FF32514700AB9A24EBA6F491C1BB7E9EA04714765185FF409D7A22DB7CFCC04A9C
                                                                                                                                                        Function 00419C50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 284sleepCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • Sleep.KERNEL32(00002710,70BC39D9,00000000,?), ref: 00419C89
                                                                                                                                                          • Part of subcall function 0040A470: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,70BC39D9,00000000), ref: 0040A4BA
                                                                                                                                                        • GetFileAttributesA.KERNEL32(?,?,00000000,00000000,00467494,0000000E), ref: 00419D05
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AttributesFileFolderPathSleep
                                                                                                                                                        • String ID: invalid stoi argument$stoi argument out of range
                                                                                                                                                        • API String ID: 70540035-1606216832
                                                                                                                                                        • Opcode ID: 59640ba2ea6eb77f42a3464dacbeae37e0a526d217bec3717b3b5d95925b2041
                                                                                                                                                        • Instruction ID: 9c9255af0806802fcb39c8da59944a5ab0d1a23febf22714bb8fa90a5f400366
                                                                                                                                                        • Opcode Fuzzy Hash: 59640ba2ea6eb77f42a3464dacbeae37e0a526d217bec3717b3b5d95925b2041
                                                                                                                                                        • Instruction Fuzzy Hash: A3C1B130D05288DFEF14DFA8C948BDDBFB6EF05308F644199D40467282D7B95A88CB66
                                                                                                                                                        Function 0043EA47 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 280COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 0043EB4B
                                                                                                                                                          • Part of subcall function 0043E55F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0043C6DF,?,00000000,00000000), ref: 0043E60B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharMultiWide_free
                                                                                                                                                        • String ID: PC$PC
                                                                                                                                                        • API String ID: 3242298965-546519453
                                                                                                                                                        • Opcode ID: 7241adb834ba55c5b2797563788f316abe133dc13884d729f81293589055bad5
                                                                                                                                                        • Instruction ID: 30f95e5b82987e201eb85a37ca92df13a8ba41c34020b510106786ecd770ee64
                                                                                                                                                        • Opcode Fuzzy Hash: 7241adb834ba55c5b2797563788f316abe133dc13884d729f81293589055bad5
                                                                                                                                                        • Instruction Fuzzy Hash: 64812571A01205ABDF10AFA6DC42ABFB7A9EB58704F54502BF9019B3C1E7399E41C758
                                                                                                                                                        Function 0043F182 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free
                                                                                                                                                        • String ID: *?
                                                                                                                                                        • API String ID: 269201875-2564092906
                                                                                                                                                        • Opcode ID: 317533a8bd29bf9178b6c3dde1179d32943e398613007d640f2a0047592b5bbe
                                                                                                                                                        • Instruction ID: 469b16dabcea248dfea556dcd6775f915f89bae5ed92b372a956dfeb83733150
                                                                                                                                                        • Opcode Fuzzy Hash: 317533a8bd29bf9178b6c3dde1179d32943e398613007d640f2a0047592b5bbe
                                                                                                                                                        • Instruction Fuzzy Hash: EC614C75E002199FDF14CFA9C8819AEFBF5EF4C314F2491AAE805E7300D639AE458B94
                                                                                                                                                        Function 00432841 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00436E90: GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                          • Part of subcall function 00436E90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        • _free.LIBCMT ref: 004328F0
                                                                                                                                                        • _free.LIBCMT ref: 0043291E
                                                                                                                                                        • _free.LIBCMT ref: 00432961
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorLast
                                                                                                                                                        • String ID: q*C
                                                                                                                                                        • API String ID: 3291180501-718014327
                                                                                                                                                        • Opcode ID: e0d68be3173fd7e35b9fb156597df15bb8683acd2e2c62fb6ea591588a37da6f
                                                                                                                                                        • Instruction ID: 8e6836e697a2de49eeba72c04aa5db1537acc4a4ccb1579c8139ebf2f11d25bb
                                                                                                                                                        • Opcode Fuzzy Hash: e0d68be3173fd7e35b9fb156597df15bb8683acd2e2c62fb6ea591588a37da6f
                                                                                                                                                        • Instruction Fuzzy Hash: 0F414A71600201AFD728DF9DC981A6AB3E9EF4D324F24166EF445C73A1EB75EC109B58
                                                                                                                                                        Function 004026A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 004289DC: std::invalid_argument::invalid_argument.LIBCONCRT ref: 004289E8
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004026E2
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copystd::invalid_argument::invalid_argument
                                                                                                                                                        • String ID: string too long$$@$$@
                                                                                                                                                        • API String ID: 3544763861-1944901011
                                                                                                                                                        • Opcode ID: e9d4f4fff1470a899ccb9be7016cfd6b13949a6589bd7cc8c0ae6d133a1d1c7a
                                                                                                                                                        • Instruction ID: 3985e699c05e29865944a5fab1fed1efc2aecf28d52ae3409e68b73f2b618db9
                                                                                                                                                        • Opcode Fuzzy Hash: e9d4f4fff1470a899ccb9be7016cfd6b13949a6589bd7cc8c0ae6d133a1d1c7a
                                                                                                                                                        • Instruction Fuzzy Hash: F7F0E971E1020C9BC714DF68E8419DEBBF4DF59304F50826FE84067201EB745A98C79D
                                                                                                                                                        Function 00402C20 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 00402C53
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: This function cannot be called on a default constructed task$$@$$@
                                                                                                                                                        • API String ID: 2659868963-2414695900
                                                                                                                                                        • Opcode ID: fcac780aed724ead00f42376415cecaa189fc3f950701ab18251edb3e17b36f1
                                                                                                                                                        • Instruction ID: 834a7a6a16d8e9a520b0fb6e9d2d411702adfd8910795d8bfdb353ad53106047
                                                                                                                                                        • Opcode Fuzzy Hash: fcac780aed724ead00f42376415cecaa189fc3f950701ab18251edb3e17b36f1
                                                                                                                                                        • Instruction Fuzzy Hash: D3F0A770E1021C9BC714DF69E8415DEFBF8DF16304F5082AFE84067201EBB41A58879D
                                                                                                                                                        Function 00402A60 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 00402A7F
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: 0*@$0*@$$@
                                                                                                                                                        • API String ID: 2659868963-1365470675
                                                                                                                                                        • Opcode ID: b62cd5dc44be1bb82b9d7d61143223bd9a6cadc01bf2671e0afe853b014c70bc
                                                                                                                                                        • Instruction ID: eb1aed04ef41e0faff7a5ec7c308904ab07fbe3e509da6de54d1c799faf7f0fa
                                                                                                                                                        • Opcode Fuzzy Hash: b62cd5dc44be1bb82b9d7d61143223bd9a6cadc01bf2671e0afe853b014c70bc
                                                                                                                                                        • Instruction Fuzzy Hash: 46F01CB6A007059B8710DF5AD800882F7E8FF59311314C62BE91897710E7B4A964CBA4
                                                                                                                                                        Function 00439288 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _strrchr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3213747228-0
                                                                                                                                                        • Opcode ID: 81afa335b41f4f710963bccd7ea6607cd356900f5081b631e9a078a8aa9009a0
                                                                                                                                                        • Instruction ID: 88368fd3f19ea0ab1fbd8861153f552b774e661e0a4dfd2e8ca94b33af587d8a
                                                                                                                                                        • Opcode Fuzzy Hash: 81afa335b41f4f710963bccd7ea6607cd356900f5081b631e9a078a8aa9009a0
                                                                                                                                                        • Instruction Fuzzy Hash: 28B13772904245AFDB118F68C8817AFBBE5EF5D304F1451ABE845EB342D6BC8D42CB68
                                                                                                                                                        Function 0042CE2B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AdjustPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1740715915-0
                                                                                                                                                        • Opcode ID: c3d1ca1c0cc0dcef1f0ec59fdcd4a37e6a636825a7af76eb0c596ff30569b59e
                                                                                                                                                        • Instruction ID: db9ea0020aec5891b3ac9e239e7814e4e34992eb7ad6218ae4218e21401c0e30
                                                                                                                                                        • Opcode Fuzzy Hash: c3d1ca1c0cc0dcef1f0ec59fdcd4a37e6a636825a7af76eb0c596ff30569b59e
                                                                                                                                                        • Instruction Fuzzy Hash: 2651DE72700222AFDB288F11E9C1B7EB7A5EF04704FA5442FE915862D1D739EC41CB89
                                                                                                                                                        Function 00409A20 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetVersionExW.KERNEL32(0000011C,?,70BC39D9), ref: 00409A99
                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409B00
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00409B07
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressHandleModuleProcVersion
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3310240892-0
                                                                                                                                                        • Opcode ID: 0064ff73fbcd5de7219555781e17cf5e180a2a0e5e39f25dc7378787160e1c2e
                                                                                                                                                        • Instruction ID: f21d22058136e34cab59ac5d13a6600816f1c8d0d7f1638f43ab2d3fbce2fef9
                                                                                                                                                        • Opcode Fuzzy Hash: 0064ff73fbcd5de7219555781e17cf5e180a2a0e5e39f25dc7378787160e1c2e
                                                                                                                                                        • Instruction Fuzzy Hash: BD512970D142589BDB14EF28DD457DDB774EB45314F5042BAE404A73D2EB389EC08B99
                                                                                                                                                        Function 0044728E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 0044735E
                                                                                                                                                        • _free.LIBCMT ref: 00447387
                                                                                                                                                        • SetEndOfFile.KERNEL32(00000000,00443AED,00000000,004374B1,?,?,?,?,?,?,?,00443AED,004374B1,00000000), ref: 004473B9
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00443AED,004374B1,00000000,?,?,?,?,00000000), ref: 004473D5
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFileLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1547350101-0
                                                                                                                                                        • Opcode ID: c9800215ebe8ef4e64c8a141c151b786dac73fb44ebe7b2115d47001fe6a627b
                                                                                                                                                        • Instruction ID: a914f7f45013df4cf9d2dafbfd2f495a1488072982b45cdeed68b9eb09e592af
                                                                                                                                                        • Opcode Fuzzy Hash: c9800215ebe8ef4e64c8a141c151b786dac73fb44ebe7b2115d47001fe6a627b
                                                                                                                                                        • Instruction Fuzzy Hash: 404126729046019BEB106FBA8C42B8F77A5AF48364F24114BFD10E72A2DB3CD842D72D
                                                                                                                                                        Function 00402F00 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Mtx_unlock$Cnd_broadcastCurrentThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3264154886-0
                                                                                                                                                        • Opcode ID: 09d96c1fa29ffac8278457d2cb62875df1707ae8ddda4c3b27a350a98ee2c43e
                                                                                                                                                        • Instruction ID: 292d85b370fb8c601e44ba8b63663a61cac4f20cd6113782830623028b1e254a
                                                                                                                                                        • Opcode Fuzzy Hash: 09d96c1fa29ffac8278457d2cb62875df1707ae8ddda4c3b27a350a98ee2c43e
                                                                                                                                                        • Instruction Fuzzy Hash: B741BDB1A016259FCB11DF25D944A5ABBE8BF18359F04453EE81AD7780EB39E900CBC9
                                                                                                                                                        Function 0043F0B3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0042ECB8: _free.LIBCMT ref: 0042ECC6
                                                                                                                                                          • Part of subcall function 0043E55F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0043C6DF,?,00000000,00000000), ref: 0043E60B
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0043F11B
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0043F122
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0043F161
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0043F168
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 167067550-0
                                                                                                                                                        • Opcode ID: 84bdc9528fd9e7c403ebabd86fce55baaa58460b3acd10314e6002622c808c1f
                                                                                                                                                        • Instruction ID: cdac29556a8506c7b74716a4605f92db769950b49fc1175bdf417ca2df574b66
                                                                                                                                                        • Opcode Fuzzy Hash: 84bdc9528fd9e7c403ebabd86fce55baaa58460b3acd10314e6002622c808c1f
                                                                                                                                                        • Instruction Fuzzy Hash: 1721DB71A00615BF9F205FA6DC8192BB7ADEF08368F10513BF819D7291D738DC4887A8
                                                                                                                                                        Function 00436E90 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436E95
                                                                                                                                                        • _free.LIBCMT ref: 00436EF2
                                                                                                                                                        • _free.LIBCMT ref: 00436F28
                                                                                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 00436F33
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast_free
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2283115069-0
                                                                                                                                                        • Opcode ID: 00c6d04b41d261aed086318db6dc780987fc9e22af0a97e0eb79cbea2e623bfe
                                                                                                                                                        • Instruction ID: 09e96cfe716c1d25de44540c3669215bf994d3ea0c2512f1aa0c19dae3e9fcf8
                                                                                                                                                        • Opcode Fuzzy Hash: 00c6d04b41d261aed086318db6dc780987fc9e22af0a97e0eb79cbea2e623bfe
                                                                                                                                                        • Instruction Fuzzy Hash: 3211E7322043027BC710376AAC82D2B22598788779F23637FF554862F2EE7DCC45411D
                                                                                                                                                        Function 004283C8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00428329: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,0042837B,00000014,?,004283BC,00000014,?,00402D32,00000000,00000014), ref: 00428335
                                                                                                                                                        • __Mtx_unlock.LIBCPMT ref: 0042840E
                                                                                                                                                        • FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,70BC39D9,?,?,?,00448990,000000FF), ref: 00428436
                                                                                                                                                        • __Mtx_unlock.LIBCPMT ref: 00428471
                                                                                                                                                        • __Cnd_broadcast.LIBCPMT ref: 00428482
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 420990631-0
                                                                                                                                                        • Opcode ID: 0e6113efdf9687dde100a925526850c593481ba3bcad5feb21b4b5dc9e57967c
                                                                                                                                                        • Instruction ID: cdbc301c448ef03e2f8ed4fb4e4af73afcf2289f0b879421e9da04729641b9c7
                                                                                                                                                        • Opcode Fuzzy Hash: 0e6113efdf9687dde100a925526850c593481ba3bcad5feb21b4b5dc9e57967c
                                                                                                                                                        • Instruction Fuzzy Hash: DF119A72740620A7D6117B52BC05E5F7768EB15B54F54452FFC0193292EE7DEC00855D
                                                                                                                                                        Function 00439F62 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,00445A97,?,?,?,00000020,00000001), ref: 00439F78
                                                                                                                                                        • GetLastError.KERNEL32(?,00445A97,?,?,?,00000020,00000001), ref: 00439F82
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00439F89
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2398240785-0
                                                                                                                                                        • Opcode ID: d2e029592764ab3ee6227ce1a8103d947bbb6e49b06dbc884c1a43c26facbefe
                                                                                                                                                        • Instruction ID: 3e1bda41e2a5e1edfa2b54557901424252c9bcbb8a73c177ffa1fe4550abdff5
                                                                                                                                                        • Opcode Fuzzy Hash: d2e029592764ab3ee6227ce1a8103d947bbb6e49b06dbc884c1a43c26facbefe
                                                                                                                                                        • Instruction Fuzzy Hash: 8FF08C32604615BB8B201FA6CC0899BBF69FF8C7A5B009126F51DC6530DB75EC61CBE8
                                                                                                                                                        Function 00439FCB Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,00445A22,?,?,?,?,00000020,00000001), ref: 00439FE1
                                                                                                                                                        • GetLastError.KERNEL32(?,00445A22,?,?,?,?,00000020,00000001), ref: 00439FEB
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00439FF2
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2398240785-0
                                                                                                                                                        • Opcode ID: b0365f2b321c4047a76c50e894978226ccf9d60bc927aec833fac521325cf5fb
                                                                                                                                                        • Instruction ID: 02562a9f25909cd91bec25567d9403d22f463ada4a75e07942653af143aca89c
                                                                                                                                                        • Opcode Fuzzy Hash: b0365f2b321c4047a76c50e894978226ccf9d60bc927aec833fac521325cf5fb
                                                                                                                                                        • Instruction Fuzzy Hash: 32F0AD32640605BB8B201FA2CC08D8BBFB9FF4C3A4B009022F51DC2520D735E861DBD9
                                                                                                                                                        Function 004475FA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004440E2,00000000,00000001,00000000,00000000,?,00437C06,?,?,00000000), ref: 00447611
                                                                                                                                                        • GetLastError.KERNEL32(?,004440E2,00000000,00000001,00000000,00000000,?,00437C06,?,?,00000000,?,00000000,?,00438155,?), ref: 0044761D
                                                                                                                                                          • Part of subcall function 004475E3: CloseHandle.KERNEL32(FFFFFFFE,0044762D,?,004440E2,00000000,00000001,00000000,00000000,?,00437C06,?,?,00000000,?,00000000), ref: 004475F3
                                                                                                                                                        • ___initconout.LIBCMT ref: 0044762D
                                                                                                                                                          • Part of subcall function 004475A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004475D4,004440CF,00000000,?,00437C06,?,?,00000000,?), ref: 004475B8
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004440E2,00000000,00000001,00000000,00000000,?,00437C06,?,?,00000000,?), ref: 00447642
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2744216297-0
                                                                                                                                                        • Opcode ID: 61908962c2c89705addcc5b8ba8671895039e27c8dcecb38e5e83e54d4de619b
                                                                                                                                                        • Instruction ID: f5b7d8764d7e513d4acbe5b2238d7f31c3efc05e885eca4315d72a35d078b765
                                                                                                                                                        • Opcode Fuzzy Hash: 61908962c2c89705addcc5b8ba8671895039e27c8dcecb38e5e83e54d4de619b
                                                                                                                                                        • Instruction Fuzzy Hash: 7AF03036004224BBDF222F95DC09A8A3F27FB097B1F014125FA1CD5531E732D8619B99
                                                                                                                                                        Function 00429ECA Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • SleepConditionVariableCS.KERNEL32(?,00429E67,00000064,?,?,?,00402E1C,0046CDC4), ref: 00429EED
                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00468FA8,00402E1C,?,00429E67,00000064,?,?,?,00402E1C,0046CDC4), ref: 00429EF7
                                                                                                                                                        • WaitForSingleObjectEx.KERNEL32(00402E1C,00000000,?,00429E67,00000064,?,?,?,00402E1C,0046CDC4), ref: 00429F08
                                                                                                                                                        • EnterCriticalSection.KERNEL32(00468FA8,?,00429E67,00000064,?,?,?,00402E1C,0046CDC4), ref: 00429F0F
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3269011525-0
                                                                                                                                                        • Opcode ID: afe086a753ee543bf81ab2aa8eb3fcdaf04ca5d5c092e525d698c959f7c84d91
                                                                                                                                                        • Instruction ID: 7c02c5e447de34fde3e066d42db9386e1c5a68f458479edeca705858c56f8afa
                                                                                                                                                        • Opcode Fuzzy Hash: afe086a753ee543bf81ab2aa8eb3fcdaf04ca5d5c092e525d698c959f7c84d91
                                                                                                                                                        • Instruction Fuzzy Hash: 1CE06D31A81224EBCA051B40EC08B8E3B16AF08763B010166F90567170DFE458108BDE
                                                                                                                                                        Function 004347CB Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _free.LIBCMT ref: 004347D4
                                                                                                                                                          • Part of subcall function 00438279: HeapFree.KERNEL32(00000000,00000000,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?), ref: 0043828F
                                                                                                                                                          • Part of subcall function 00438279: GetLastError.KERNEL32(?,?,0044125C,?,00000000,?,?,?,004414FF,?,00000007,?,?,004419A4,?,?), ref: 004382A1
                                                                                                                                                        • _free.LIBCMT ref: 004347E7
                                                                                                                                                        • _free.LIBCMT ref: 004347F8
                                                                                                                                                        • _free.LIBCMT ref: 00434809
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 776569668-0
                                                                                                                                                        • Opcode ID: 01caac258aac6b6712d6790cdd87dd8d9563967e9898c5393353104566d3ce8e
                                                                                                                                                        • Instruction ID: ebd1395a083c2a9b96b6993cca00230b5ceaec78d98073331f478d71671cdd9d
                                                                                                                                                        • Opcode Fuzzy Hash: 01caac258aac6b6712d6790cdd87dd8d9563967e9898c5393353104566d3ce8e
                                                                                                                                                        • Instruction Fuzzy Hash: 4DE09AB5411721AA8E016F27EC01487BA29A748714B01506EF40812236EBFD0D569FCE
                                                                                                                                                        Function 0040DB20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00424990: std::locale::_Init.LIBCPMT ref: 00424A22
                                                                                                                                                        • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040DD18
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitIos_base_dtorstd::ios_base::_std::locale::_
                                                                                                                                                        • String ID: `$vB
                                                                                                                                                        • API String ID: 3469404174-1229146614
                                                                                                                                                        • Opcode ID: f511d4f1eb7d17d550ff342d7a8369855c821c1ce319df7038167ec87c5d9f4f
                                                                                                                                                        • Instruction ID: a37c01b23f3a1ba7911581b94c8e799fe8336021f928bc16adb6b305b96d4d24
                                                                                                                                                        • Opcode Fuzzy Hash: f511d4f1eb7d17d550ff342d7a8369855c821c1ce319df7038167ec87c5d9f4f
                                                                                                                                                        • Instruction Fuzzy Hash: DB714F70A01258DFEB14DF64DD94B9EB7B4FF44304F5085AEE809AB281D7799A88CF44
                                                                                                                                                        Function 00433C34 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        • API String ID: 0-1068371695
                                                                                                                                                        • Opcode ID: 6b3a865d252ff2a7b7e7a4c739316fb0c905349a3fc63c879e105d2ad9df7371
                                                                                                                                                        • Instruction ID: a045483f9e0d170a950a84ae75d3a934100293179bd6455b2a236eefd17be744
                                                                                                                                                        • Opcode Fuzzy Hash: 6b3a865d252ff2a7b7e7a4c739316fb0c905349a3fc63c879e105d2ad9df7371
                                                                                                                                                        • Instruction Fuzzy Hash: 80417171A00214AFDB219F9ADC819AFBBB8EB89311F50106BF405E7211E7B89F41CB59
                                                                                                                                                        Function 0042D42C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0042D451
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EncodePointer
                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                        • API String ID: 2118026453-2084237596
                                                                                                                                                        • Opcode ID: 1e5c716ec9ca0cc75a4ff98ebbe796bffaafd2204b00bcdefc01ec315ac6a93a
                                                                                                                                                        • Instruction ID: aac2cd0b0fbd40e68606ed1f29063b1f0a7768e89fcc67e939171cb7d75c0890
                                                                                                                                                        • Opcode Fuzzy Hash: 1e5c716ec9ca0cc75a4ff98ebbe796bffaafd2204b00bcdefc01ec315ac6a93a
                                                                                                                                                        • Instruction Fuzzy Hash: FF41AE71E00229AFCF15DF98EC81AEE7BB5FF48308F54809AF905A7211D3399990CB59
                                                                                                                                                        Function 0042817A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 00428202
                                                                                                                                                        • RaiseException.KERNEL32(?,?,?,?), ref: 00428227
                                                                                                                                                          • Part of subcall function 0042B3B6: RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                          • Part of subcall function 0042E2D4: IsProcessorFeaturePresent.KERNEL32(00000017,00436F4C,?,?,0042E597,?,?,?,?,0042F14E,?), ref: 0042E2F0
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
                                                                                                                                                        • String ID: csm
                                                                                                                                                        • API String ID: 1924019822-1018135373
                                                                                                                                                        • Opcode ID: 0b8eab2a68fd84073772be15753fde118af4fa124b130b13397f5a0b2b735864
                                                                                                                                                        • Instruction ID: 7eb943577791ec5b31873293a89559f877af8a423c8b84d21deed3ec6ab670f8
                                                                                                                                                        • Opcode Fuzzy Hash: 0b8eab2a68fd84073772be15753fde118af4fa124b130b13397f5a0b2b735864
                                                                                                                                                        • Instruction Fuzzy Hash: DD21B031E01228DBCF24DF95E8416AEB7B8AF04714F98001FE805AB355CB38AD46CB99
                                                                                                                                                        Function 0042EBAA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0042ECB8: _free.LIBCMT ref: 0042ECC6
                                                                                                                                                          • Part of subcall function 004384F6: MultiByteToWideChar.KERNEL32(0043FEB8,00000100,E8458D00,00000000,00000000,00000020,?,0043C47D,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 00438566
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,0042ED6F,00000000,?,00000000,6F7F0EF0), ref: 0042EC0E
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0042EC15
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ByteCharErrorLastMultiWide__dosmaperr_free
                                                                                                                                                        • String ID: oB
                                                                                                                                                        • API String ID: 4030486722-1424428939
                                                                                                                                                        • Opcode ID: 3c6745936a6976f47505e618f33cc1ba61a238f28cae629ec1cfd8ab9cb9e017
                                                                                                                                                        • Instruction ID: 7a5766e2e50ade74104ce698c19eab0300cf8f14a91f25cdede33ebac1fdb064
                                                                                                                                                        • Opcode Fuzzy Hash: 3c6745936a6976f47505e618f33cc1ba61a238f28cae629ec1cfd8ab9cb9e017
                                                                                                                                                        • Instruction Fuzzy Hash: 0D2108327042256BDB219F579C01A1BB794EF90360F90411FF829E7291D738F8108799
                                                                                                                                                        Function 004044C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 004044EB
                                                                                                                                                        • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040453A
                                                                                                                                                          • Part of subcall function 00428CAE: _Yarn.LIBCPMT ref: 00428CCD
                                                                                                                                                          • Part of subcall function 00428CAE: _Yarn.LIBCPMT ref: 00428CF1
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                        • String ID: bad locale name
                                                                                                                                                        • API String ID: 1908188788-1405518554
                                                                                                                                                        • Opcode ID: b0a2a8a89bc6c9d183c57ebe637722bb2a546cab01997332e16e4f63759da1c1
                                                                                                                                                        • Instruction ID: b5918543850773d29160a3f74c84d8eabe3f8ad37793197a9f490c9f393b7ff9
                                                                                                                                                        • Opcode Fuzzy Hash: b0a2a8a89bc6c9d183c57ebe637722bb2a546cab01997332e16e4f63759da1c1
                                                                                                                                                        • Instruction Fuzzy Hash: 6411A3715057449FD320CF69C90174BBBE4EF19714F004A1FE899D7B81E7B9A504CBA9
                                                                                                                                                        Function 0042A115 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004025FE
                                                                                                                                                          • Part of subcall function 0042B3B6: RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise___std_exception_copy
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 3109751735-431066289
                                                                                                                                                        • Opcode ID: 90094bfc4b2d90f3baa9964a3cf6efc3a603a8c44fccca98be743e1ed40588d3
                                                                                                                                                        • Instruction ID: c384f4c14906aeae79a8fc0141cad683682844774c1e4ead33d14cb8ba72b0b1
                                                                                                                                                        • Opcode Fuzzy Hash: 90094bfc4b2d90f3baa9964a3cf6efc3a603a8c44fccca98be743e1ed40588d3
                                                                                                                                                        • Instruction Fuzzy Hash: CB014C3590020CB7C710FEA5EC0195AB36CDE00314F90852BFD14A71C2FB78EA6486DE
                                                                                                                                                        Function 00408630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004086D7
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                        • String ID: vB$vB
                                                                                                                                                        • API String ID: 323602529-4289607641
                                                                                                                                                        • Opcode ID: 011de8a1e87f1c6f0f18bf5b6f1f528e1ddaaf53b5d23c3d846b555e7b1cf400
                                                                                                                                                        • Instruction ID: 00873bccf2ab0dad9bb54da0f851262d0e1fd1efd1b089c726eb6dbf88cadb63
                                                                                                                                                        • Opcode Fuzzy Hash: 011de8a1e87f1c6f0f18bf5b6f1f528e1ddaaf53b5d23c3d846b555e7b1cf400
                                                                                                                                                        • Instruction Fuzzy Hash: 0E210778600245CFEB21CF0AC584E58BBF4FB09318F55889EE88A8B352D776E945CF44
                                                                                                                                                        Function 004415CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _free
                                                                                                                                                        • String ID: OE
                                                                                                                                                        • API String ID: 269201875-2506519113
                                                                                                                                                        • Opcode ID: 8c72c469ecdc2b54c7fb4360f9caf4c628fa6ebb31438ba63c18d1ae842345a8
                                                                                                                                                        • Instruction ID: e26c02bfe0f8c3404876141ada75881917cda9a363f201002bf455a686eebc10
                                                                                                                                                        • Opcode Fuzzy Hash: 8c72c469ecdc2b54c7fb4360f9caf4c628fa6ebb31438ba63c18d1ae842345a8
                                                                                                                                                        • Instruction Fuzzy Hash: 6FF0A4334087106BFB152A63AC42B977759EB857B8F25006FF80C9A153DE69588241BE
                                                                                                                                                        Function 00437710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0043A350: EnterCriticalSection.KERNEL32(00000000,?,00438011,00000000,00464200,00000010,00431192,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0043A36B
                                                                                                                                                        • FlushFileBuffers.KERNEL32(00000000,004641E0,0000000C,00437817,>B,?,00000001,?,0042E93E,?), ref: 00437759
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0043776A
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BuffersCriticalEnterErrorFileFlushLastSection
                                                                                                                                                        • String ID: >B
                                                                                                                                                        • API String ID: 4109680722-1368713712
                                                                                                                                                        • Opcode ID: 8cab3ac8b2845ae3f2e8e00a05992b0931c1708064a76113e3808aed480a71a0
                                                                                                                                                        • Instruction ID: ed6682528f6f05121493685a91848a7bc331827969927d85d96b4ef55a7c7a1f
                                                                                                                                                        • Opcode Fuzzy Hash: 8cab3ac8b2845ae3f2e8e00a05992b0931c1708064a76113e3808aed480a71a0
                                                                                                                                                        • Instruction Fuzzy Hash: DF01D276A003109FC710AFA9D805A4E7BA1EB4D724F14415FF851EB3E1DB78E841CB48
                                                                                                                                                        Function 0042A046 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042A051
                                                                                                                                                        • ___raise_securityfailure.LIBCMT ref: 0042A10E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                        • String ID: %ZC
                                                                                                                                                        • API String ID: 3761405300-1850145005
                                                                                                                                                        • Opcode ID: b3b398a713e9c6d1b3f5f4cee0cc5926baef2b80cc2e71b08a99c2fbb0c98177
                                                                                                                                                        • Instruction ID: e26853b9f10a968c69658aaae485ac455b93cf6484ca92403435566ee841b87e
                                                                                                                                                        • Opcode Fuzzy Hash: b3b398a713e9c6d1b3f5f4cee0cc5926baef2b80cc2e71b08a99c2fbb0c98177
                                                                                                                                                        • Instruction Fuzzy Hash: 951199B8615204EFDB04DF19E9816817BB9BB18300B04913AE9088B3A1F7F19949CF9F
                                                                                                                                                        Function 0042B3B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise
                                                                                                                                                        • String ID: l:F$l:F
                                                                                                                                                        • API String ID: 3997070919-2007187516
                                                                                                                                                        • Opcode ID: 1582839b7ccfcf148add1d7f679e3b2553cb9e29d49e35ae81638c5c6a0958a5
                                                                                                                                                        • Instruction ID: f6d93103d6599e48d2d3430ca5391a4130f8718176e9729a98df915084cdf4fa
                                                                                                                                                        • Opcode Fuzzy Hash: 1582839b7ccfcf148add1d7f679e3b2553cb9e29d49e35ae81638c5c6a0958a5
                                                                                                                                                        • Instruction Fuzzy Hash: 07017135A00218ABD7019F59D854B9EBBB8FF48704F15415AED459B361D7B499018BD0
                                                                                                                                                        Function 004032B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00402C20: ___std_exception_copy.LIBVCRUNTIME ref: 00402C53
                                                                                                                                                          • Part of subcall function 0042B3B6: RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004032EE
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy$ExceptionRaise
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 2103344913-431066289
                                                                                                                                                        • Opcode ID: a3f64a996731e72a8c2cefd06053dcccc126eabf4f482dfa20e799bf14fda65d
                                                                                                                                                        • Instruction ID: 8782c05d7d43eb56eae7dd4164e99aaaa621897c8e3caa251499ae95f82f568e
                                                                                                                                                        • Opcode Fuzzy Hash: a3f64a996731e72a8c2cefd06053dcccc126eabf4f482dfa20e799bf14fda65d
                                                                                                                                                        • Instruction Fuzzy Hash: 6DF0E572D1020C67C704EBE9DC0198AF7ACDE15704B50892BFA10A7502FB74BA5887AD
                                                                                                                                                        Function 004025C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0042B3B6: RaiseException.KERNEL32(E06D7363,00000001,00000003,l:F,?,?,?,00463A6C), ref: 0042B416
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004025FE
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionRaise___std_exception_copy
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 3109751735-431066289
                                                                                                                                                        • Opcode ID: 9ec82e1c527c6ab5405e5fcaa1b23060d47304592dbc129c81df5c506249d5f8
                                                                                                                                                        • Instruction ID: bfcc3eaeb41048370592c6883181fb4b6297d4bbad094734cf2efdcd35f3c6c8
                                                                                                                                                        • Opcode Fuzzy Hash: 9ec82e1c527c6ab5405e5fcaa1b23060d47304592dbc129c81df5c506249d5f8
                                                                                                                                                        • Instruction Fuzzy Hash: B9F0A075D0020C67C714EAE5EC0198AB3ACDA11304B50892BFA14A7542F7B4BA5487DD
                                                                                                                                                        Function 004026B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 004026E2
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 2659868963-431066289
                                                                                                                                                        • Opcode ID: 2a8acc9910f25cb22827eb5aacae2a098d32424a5f63aa8938ea8bc119a076e2
                                                                                                                                                        • Instruction ID: 2abef987a3d0adb694f36e3f40770f395c7866e919a418bd84edbc24f21ba152
                                                                                                                                                        • Opcode Fuzzy Hash: 2a8acc9910f25cb22827eb5aacae2a098d32424a5f63aa8938ea8bc119a076e2
                                                                                                                                                        • Instruction Fuzzy Hash: 21F08271E1020C9BC714DF68D8419DEBBF8AF59304F5082AFE84067201EB745A988B99
                                                                                                                                                        Function 00402AB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 00402ACF
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: 0*@$$@
                                                                                                                                                        • API String ID: 2659868963-3718208268
                                                                                                                                                        • Opcode ID: 40d6af2cbe2eae9d2859cefb893a30da7ad0705faf66008e8e31944f8d5c3f25
                                                                                                                                                        • Instruction ID: 1874ed3c4729164a826117937661336130adc3890ae07282781db7784a6c9947
                                                                                                                                                        • Opcode Fuzzy Hash: 40d6af2cbe2eae9d2859cefb893a30da7ad0705faf66008e8e31944f8d5c3f25
                                                                                                                                                        • Instruction Fuzzy Hash: 54E039B6A00705AB8300DF5AD800886F7ECFE6A321344C62BE91897A10F770B864CBA4
                                                                                                                                                        Function 00402620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 0040263E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 2659868963-431066289
                                                                                                                                                        • Opcode ID: 0dea935cdad9d4d45a659ebf336175095d250c15ac361fdc328198e83f3129e3
                                                                                                                                                        • Instruction ID: 9a6f635d05f5770c922f17afaa5724279a8e6a5c5afd35ab93ba8b2b2e2d4e63
                                                                                                                                                        • Opcode Fuzzy Hash: 0dea935cdad9d4d45a659ebf336175095d250c15ac361fdc328198e83f3129e3
                                                                                                                                                        • Instruction Fuzzy Hash: 7BD02BB2A1031457C300DF98DC00982F7DCDE25355344C52BF544E7201F370E89087E8
                                                                                                                                                        Function 00402710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_copy.LIBVCRUNTIME ref: 0040272E
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000D.00000002.2739206205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_copy
                                                                                                                                                        • String ID: $@$$@
                                                                                                                                                        • API String ID: 2659868963-431066289
                                                                                                                                                        • Opcode ID: 955f4791334f5246795b5704ae8054b439d64b332b5eb6e040a142cea33a46b0
                                                                                                                                                        • Instruction ID: 33f6e692760bc7b5d38e18b407136c59930b80a8cdb18a7a2fbe07891efe707c
                                                                                                                                                        • Opcode Fuzzy Hash: 955f4791334f5246795b5704ae8054b439d64b332b5eb6e040a142cea33a46b0
                                                                                                                                                        • Instruction Fuzzy Hash: 09D0C2B2A1021457C3009F98D800982B7DCDE15355344C12BF544E7201F3B0A89087E8

                                                                                                                                                        Execution Graph

                                                                                                                                                        Execution Coverage:3.3%
                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                        Signature Coverage:31.3%
                                                                                                                                                        Total number of Nodes:182
                                                                                                                                                        Total number of Limit Nodes:10
                                                                                                                                                        execution_graph 34291 43dce0 34292 43dd10 34291->34292 34293 43dd9e 34292->34293 34299 440d90 LdrInitializeThunk 34292->34299 34296 43dece 34293->34296 34297 43df63 34293->34297 34300 440d90 LdrInitializeThunk 34293->34300 34295 43dc40 RtlFreeHeap 34295->34297 34296->34295 34299->34293 34300->34296 34236 4100c5 34238 40fcc0 34236->34238 34239 40fcfd 34236->34239 34239->34238 34239->34239 34240 440cc0 34239->34240 34241 440cea 34240->34241 34242 440d52 RtlReAllocateHeap 34240->34242 34243 440cdc 34240->34243 34244 440d6c 34240->34244 34245 440d61 34240->34245 34241->34242 34242->34245 34243->34241 34243->34242 34243->34244 34247 43dc40 34244->34247 34245->34239 34248 43dcd3 34247->34248 34249 43dc58 RtlFreeHeap 34247->34249 34248->34245 34249->34248 34301 440f68 34302 440f71 GetForegroundWindow 34301->34302 34303 440f84 34302->34303 34304 41d5af 34305 41d5b4 34304->34305 34314 444110 34305->34314 34307 41d5ca 34309 41d603 34307->34309 34312 41d6ce 34307->34312 34313 41d88d 34307->34313 34318 4441f0 34307->34318 34309->34312 34309->34313 34324 440d90 LdrInitializeThunk 34309->34324 34311 41d863 CryptUnprotectData 34311->34313 34312->34311 34312->34313 34316 444140 34314->34316 34315 44419e 34315->34307 34316->34315 34325 440d90 LdrInitializeThunk 34316->34325 34319 444210 34318->34319 34322 44426e 34319->34322 34326 440d90 LdrInitializeThunk 34319->34326 34320 44432e 34320->34309 34322->34320 34327 440d90 LdrInitializeThunk 34322->34327 34324->34312 34325->34315 34326->34322 34327->34320 34333 40d0b0 34334 40d0c0 34333->34334 34335 40d277 ExitProcess 34334->34335 34336 40d0f1 GetCurrentThreadId 34334->34336 34343 40d264 34334->34343 34338 40d180 34336->34338 34337 40d24f GetForegroundWindow 34339 40d259 GetCurrentProcessId 34337->34339 34340 40d25f 34337->34340 34338->34337 34338->34338 34342 40d236 ShellExecuteW 34338->34342 34339->34340 34344 40e1c0 34340->34344 34342->34337 34343->34335 34345 40e200 34344->34345 34345->34345 34346 40e27e LoadLibraryExW 34345->34346 34347 40e293 34346->34347 34347->34343 34252 4413d5 34253 4413e6 34252->34253 34255 44143e 34253->34255 34259 440d90 LdrInitializeThunk 34253->34259 34258 440d90 LdrInitializeThunk 34255->34258 34257 44156f 34258->34257 34259->34255 34260 424750 34261 4247a0 34260->34261 34262 42475e 34260->34262 34266 424860 34262->34266 34264 42481c 34264->34261 34265 422e50 LdrInitializeThunk 34264->34265 34265->34261 34267 424870 34266->34267 34267->34267 34270 443f40 34267->34270 34269 42495f 34271 443f60 34270->34271 34272 4440be 34271->34272 34274 440d90 LdrInitializeThunk 34271->34274 34272->34269 34274->34272 34353 4359b7 34354 4359bc 34353->34354 34355 4359f2 GetSystemMetrics GetSystemMetrics 34354->34355 34356 435a31 34355->34356 34357 4410f1 34358 441140 34357->34358 34359 44126e 34358->34359 34361 440d90 LdrInitializeThunk 34358->34361 34361->34359 34362 4107f7 CoInitialize 34363 410800 CoInitialize 34362->34363 34364 41090c 34363->34364 34365 41091c CoInitializeSecurity 34364->34365 34366 410c5f CoUninitialize 34364->34366 34367 410c6f GetSystemDirectoryW 34364->34367 34368 41093e 34364->34368 34407 410c65 34364->34407 34365->34366 34365->34367 34365->34368 34366->34407 34367->34368 34368->34366 34368->34367 34369 43dc40 RtlFreeHeap 34368->34369 34370 410dac 34368->34370 34369->34368 34409 427230 34370->34409 34372 410f31 34373 40db20 19 API calls 34372->34373 34374 410f3b 34373->34374 34375 4279a0 LdrInitializeThunk 34374->34375 34376 410f4d 34375->34376 34377 40db20 19 API calls 34376->34377 34378 410f57 34377->34378 34379 427b90 LdrInitializeThunk 34378->34379 34380 410f69 34379->34380 34381 40db20 19 API calls 34380->34381 34382 410f73 34381->34382 34383 429d00 RtlFreeHeap RtlReAllocateHeap LdrInitializeThunk 34382->34383 34384 410f85 34383->34384 34385 42a6d0 RtlFreeHeap LdrInitializeThunk 34384->34385 34386 410f8e 34385->34386 34387 42aa40 CopyFileW RtlFreeHeap LdrInitializeThunk 34386->34387 34388 410f97 34387->34388 34389 42d360 LdrInitializeThunk 34388->34389 34390 410fa0 34389->34390 34391 40db20 19 API calls 34390->34391 34392 410faa 34391->34392 34393 40db20 19 API calls 34392->34393 34394 410fc6 34393->34394 34395 42eb60 GetComputerNameExA GetComputerNameExA GetPhysicallyInstalledSystemMemory LdrInitializeThunk 34394->34395 34396 410fd8 34395->34396 34397 435210 6 API calls 34396->34397 34403 410fe1 34397->34403 34398 40db20 19 API calls 34399 410ffb CoUninitialize 34398->34399 34399->34403 34400 43dc40 RtlFreeHeap 34400->34403 34401 411459 34402 40db20 19 API calls 34401->34402 34404 4114f9 34402->34404 34403->34398 34403->34400 34403->34401 34403->34403 34405 440d90 LdrInitializeThunk 34404->34405 34406 4117e1 34404->34406 34404->34407 34405->34406 34406->34407 34408 440d90 LdrInitializeThunk 34406->34408 34408->34407 34411 427250 34409->34411 34410 443f40 LdrInitializeThunk 34413 427480 34410->34413 34411->34410 34411->34411 34412 4275f1 GetLogicalDrives 34414 443f40 LdrInitializeThunk 34412->34414 34413->34412 34413->34413 34415 427605 34414->34415 34416 415b37 34417 415b82 34416->34417 34422 41c6e0 34417->34422 34423 41c6f3 34422->34423 34426 443da0 34423->34426 34425 41c86d 34428 443db0 34426->34428 34427 443eee 34427->34425 34428->34427 34430 440d90 LdrInitializeThunk 34428->34430 34430->34427 34280 431859 34283 41c2a0 34280->34283 34282 43185e CoSetProxyBlanket 34283->34282 34284 43dc18 34285 43dc1e RtlAllocateHeap 34284->34285 34431 434a7f CoSetProxyBlanket 34432 43a97e 34433 43a9a0 34432->34433 34433->34433 34434 43a9e0 SysAllocString 34433->34434 34435 43aa50 34434->34435 34435->34435 34436 43aa7d SysAllocString 34435->34436 34437 43aa9e 34436->34437 34438 43ac8a VariantClear 34437->34438 34439 43ae0d SysFreeString SysFreeString 34437->34439 34440 43add9 SysFreeString 34437->34440 34441 43aaee VariantInit 34437->34441 34442 43adfd SysFreeString SysFreeString 34437->34442 34444 43ab40 34437->34444 34445 43acb2 34437->34445 34449 43ac73 34437->34449 34461 43ac9f 34437->34461 34438->34461 34439->34461 34452 43adf8 34440->34452 34441->34444 34442->34439 34443 43b145 34448 443da0 LdrInitializeThunk 34443->34448 34444->34438 34444->34439 34444->34440 34444->34442 34444->34445 34444->34449 34444->34461 34445->34443 34450 43b0fe 34445->34450 34454 43ae68 34445->34454 34445->34461 34446 443da0 LdrInitializeThunk 34446->34443 34451 43b15b 34448->34451 34449->34438 34450->34446 34452->34442 34453 43aff2 34458 43dc40 RtlFreeHeap 34453->34458 34454->34453 34455 43aef4 34454->34455 34457 43e140 LdrInitializeThunk 34454->34457 34459 43af01 34454->34459 34462 43dfb0 LdrInitializeThunk 34454->34462 34463 43e230 LdrInitializeThunk 34455->34463 34457->34454 34458->34461 34462->34454 34463->34459 34286 42509d 34288 4250c1 34286->34288 34289 425163 34288->34289 34290 440d90 LdrInitializeThunk 34288->34290 34290->34288

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00410130 Relevance: 43.9, APIs: 4, Strings: 20, Instructions: 1884COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: #Tw$2E108DCD850671107918836354B1FBC2$;:54$;:54$=i<o$F]$J!G'$K=C#$Noni$T1S7$U`3$V[$_]$`1d7$d5h;$f[zU$goalyfeastz.site$xr${){/${-S
                                                                                                                                                        • API String ID: 0-1703252191
                                                                                                                                                        • Opcode ID: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
                                                                                                                                                        • Instruction ID: 6273a6f89015048420069fd8e76e9716c3636ab33a276e99926261cacd246b67
                                                                                                                                                        • Opcode Fuzzy Hash: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
                                                                                                                                                        • Instruction Fuzzy Hash: 9ED243B56047408FD3248F25D88176BBBF1FF86304F18856DE5968B3A2D779E806CB86
                                                                                                                                                        Function 0042EB60 Relevance: 32.6, APIs: 5, Strings: 12, Instructions: 2801COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF$#v
                                                                                                                                                        • API String ID: 0-836178142
                                                                                                                                                        • Opcode ID: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
                                                                                                                                                        • Instruction ID: 1668301a4a25afde2e4d19bd0ad22d91ff18bef6338bf9f0b8afd95663acfb5e
                                                                                                                                                        • Opcode Fuzzy Hash: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
                                                                                                                                                        • Instruction Fuzzy Hash: F7131874604B908BE7358F35D4A07A3BBE1AF57304F4889AEC1EB4B386D779A409CB15
                                                                                                                                                        Function 00410118 Relevance: 29.8, APIs: 4, Strings: 12, Instructions: 1780COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: #Tw$2E108DCD850671107918836354B1FBC2$;:54$;:54$F]$Noni$T1S7$V[$_]$f[zU$goalyfeastz.site$xr
                                                                                                                                                        • API String ID: 0-3487675022
                                                                                                                                                        • Opcode ID: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
                                                                                                                                                        • Instruction ID: 2214ddb4aa977259affe9d128b542b83af94708bdbd03a589afbbb747fa6f94c
                                                                                                                                                        • Opcode Fuzzy Hash: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
                                                                                                                                                        • Instruction Fuzzy Hash: 43C264B56047408FD3248F25D891727BBF1FF86304F1885ADE4968B7A2D77AE806CB85
                                                                                                                                                        Function 0042F4DD Relevance: 22.9, APIs: 5, Strings: 7, Instructions: 1934COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042F89E
                                                                                                                                                        • GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042F986
                                                                                                                                                        • GetPhysicallyInstalledSystemMemory.KERNELBASE(00000000), ref: 0043009C
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ComputerName$InstalledMemoryPhysicallySystem
                                                                                                                                                        • String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF$#v
                                                                                                                                                        • API String ID: 1996838884-836178142
                                                                                                                                                        • Opcode ID: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
                                                                                                                                                        • Instruction ID: 720d6aa5ae566c4ed92dd2e9e444606c90beba08f29df70a540f1b78ea5a33a4
                                                                                                                                                        • Opcode Fuzzy Hash: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
                                                                                                                                                        • Instruction Fuzzy Hash: C1D2D775604B818FE7258F35D4A07A3BBE1AF57304F4889AEC0EB4B782D779A409CB15
                                                                                                                                                        Function 0043A97E Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 587memoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1369 43a97e-43a993 1370 43a9a0-43a9de 1369->1370 1370->1370 1371 43a9e0-43aa4f SysAllocString 1370->1371 1372 43aa50-43aa7b 1371->1372 1372->1372 1373 43aa7d-43aaa3 SysAllocString 1372->1373 1375 43adc2-43adca 1373->1375 1376 43adc0 1373->1376 1377 43ad4b 1373->1377 1378 43ac8a-43aca4 VariantClear 1373->1378 1379 43ad4e-43ad76 call 4223f0 1373->1379 1380 43ae0d-43ae1b SysFreeString * 2 1373->1380 1381 43add1-43add8 1373->1381 1382 43ae50-43ae54 1373->1382 1383 43add9-43ade0 1373->1383 1384 43ae58 1373->1384 1385 43ac63-43ac6c 1373->1385 1386 43aba1-43abb4 1373->1386 1387 43ad20-43ad29 1373->1387 1388 43ada0-43adad 1373->1388 1389 43aaaa 1373->1389 1390 43aaee-43ab3a VariantInit 1373->1390 1391 43ac73-43ac76 1373->1391 1392 43acb2-43acba 1373->1392 1393 43aab0-43aac8 1373->1393 1394 43ac30-43ac5c 1373->1394 1395 43acb0 1373->1395 1396 43ad30 1373->1396 1397 43ad36-43ad44 1373->1397 1398 43adb4-43adbb 1373->1398 1399 43ac7f-43ac87 call 40c8c0 1373->1399 1400 43adfd-43ae0b SysFreeString * 2 1373->1400 1401 43acfd-43ad0e 1373->1401 1375->1375 1375->1376 1375->1377 1375->1379 1375->1381 1375->1382 1375->1384 1375->1387 1375->1388 1375->1396 1375->1397 1375->1398 1407 43b132-43b145 call 443da0 1375->1407 1408 43b0f2-43b0f7 1375->1408 1409 43b148-43b15b call 443da0 1375->1409 1377->1379 1378->1395 1433 43ad80-43ad88 1379->1433 1380->1382 1382->1384 1425 43ade4-43adf8 SysFreeString 1383->1425 1411 43ae5e 1384->1411 1385->1375 1385->1376 1385->1377 1385->1378 1385->1379 1385->1380 1385->1381 1385->1382 1385->1383 1385->1384 1385->1385 1385->1387 1385->1388 1385->1391 1385->1392 1385->1394 1385->1395 1385->1396 1385->1397 1385->1398 1385->1399 1385->1400 1385->1401 1403 43abb6-43abbe 1386->1403 1404 43abed-43ac1d call 40c8b0 call 42a570 1386->1404 1387->1375 1387->1376 1387->1377 1387->1379 1387->1382 1387->1384 1387->1388 1387->1396 1387->1397 1387->1398 1388->1375 1388->1376 1388->1382 1388->1384 1388->1388 1388->1398 1388->1407 1388->1408 1388->1409 1389->1393 1402 43ab40-43ab76 1390->1402 1391->1399 1392->1401 1412 43aacc-43aae7 1393->1412 1394->1375 1394->1376 1394->1377 1394->1378 1394->1379 1394->1380 1394->1381 1394->1382 1394->1383 1394->1384 1394->1385 1394->1387 1394->1388 1394->1391 1394->1392 1394->1395 1394->1396 1394->1397 1394->1398 1394->1399 1394->1400 1394->1401 1396->1397 1397->1375 1397->1376 1397->1377 1397->1379 1397->1382 1397->1384 1397->1388 1397->1398 1398->1376 1399->1378 1400->1380 1401->1375 1401->1376 1401->1377 1401->1379 1401->1381 1401->1382 1401->1384 1401->1387 1401->1388 1401->1396 1401->1397 1401->1398 1402->1402 1414 43ab78-43ab85 1402->1414 1415 43abcc-43abd0 1403->1415 1404->1375 1404->1376 1404->1377 1404->1378 1404->1379 1404->1380 1404->1381 1404->1382 1404->1383 1404->1384 1404->1385 1404->1387 1404->1388 1404->1391 1404->1392 1404->1394 1404->1395 1404->1396 1404->1397 1404->1398 1404->1399 1404->1400 1404->1401 1407->1409 1408->1411 1416 43b112-43b11c call 43dbb0 1408->1416 1417 43b110 1408->1417 1418 43b11f-43b129 call 43dbb0 1408->1418 1419 43b0fe-43b103 1408->1419 1420 43b0ec 1408->1420 1421 43af2c-43af46 1408->1421 1428 43ae60-43ae67 1411->1428 1412->1375 1412->1376 1412->1377 1412->1378 1412->1379 1412->1380 1412->1381 1412->1382 1412->1383 1412->1384 1412->1385 1412->1386 1412->1387 1412->1388 1412->1390 1412->1391 1412->1392 1412->1394 1412->1395 1412->1396 1412->1397 1412->1398 1412->1399 1412->1400 1412->1401 1438 43ab89-43ab9a 1414->1438 1429 43abd2-43abdb 1415->1429 1430 43abc0 1415->1430 1416->1418 1417->1416 1418->1407 1419->1417 1420->1408 1432 43af50-43afa3 1421->1432 1425->1400 1440 43abe2-43abe6 1429->1440 1441 43abdd-43abe0 1429->1441 1439 43abc1-43abca 1430->1439 1432->1432 1446 43afa5-43afb3 1432->1446 1433->1433 1442 43ad8a-43ad94 1433->1442 1438->1375 1438->1376 1438->1377 1438->1378 1438->1379 1438->1380 1438->1381 1438->1382 1438->1383 1438->1384 1438->1385 1438->1386 1438->1387 1438->1388 1438->1391 1438->1392 1438->1394 1438->1395 1438->1396 1438->1397 1438->1398 1438->1399 1438->1400 1438->1401 1439->1404 1439->1415 1440->1439 1448 43abe8-43abeb 1440->1448 1441->1439 1442->1375 1442->1376 1442->1382 1442->1384 1442->1388 1442->1398 1442->1407 1442->1408 1442->1409 1450 43afb5-43afbf 1446->1450 1451 43afdc-43afeb 1446->1451 1448->1439 1461 43afc0-43afcc 1450->1461 1452 43aff2-43b00f call 43dc40 1451->1452 1453 43aea2-43aeed call 43df80 call 43dfb0 1451->1453 1454 43af12 1451->1454 1455 43af10 1451->1455 1456 43ae90-43ae9b 1451->1456 1457 43aef4-43af0f call 43e230 1451->1457 1458 43ae68-43ae7a 1451->1458 1459 43af18-43af1a call 43e140 1451->1459 1460 43af1f-43af26 call 43e140 1451->1460 1474 43b010-43b065 1452->1474 1453->1454 1453->1455 1453->1456 1453->1457 1453->1459 1453->1460 1456->1452 1456->1453 1456->1454 1456->1455 1456->1456 1456->1457 1456->1459 1456->1460 1457->1455 1458->1452 1458->1453 1458->1454 1458->1455 1458->1456 1458->1457 1458->1459 1458->1460 1459->1460 1460->1421 1472 43afce 1461->1472 1472->1451 1474->1474 1475 43b067-43b06f 1474->1475 1477 43b071-43b07f 1475->1477 1478 43b0aa-43b0af 1475->1478 1479 43b080-43b08c 1477->1479 1478->1428 1481 43b08e 1479->1481 1481->1478
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocString
                                                                                                                                                        • String ID: ;:54$;:54
                                                                                                                                                        • API String ID: 2525500382-2193779323
                                                                                                                                                        • Opcode ID: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
                                                                                                                                                        • Instruction ID: 2cdab4973b36a2ceba13e1940af5890ec94b31d07d7f00d7a7e93af7ed3afa87
                                                                                                                                                        • Opcode Fuzzy Hash: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
                                                                                                                                                        • Instruction Fuzzy Hash: 9012657AA00701DFD724CF25D880B2AB7B2FF8A300F14856DD5968B7A1D739E816CB84
                                                                                                                                                        Function 00426800 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1152COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: ;:54$InA>$InA>$P$SV$bqB
                                                                                                                                                        • API String ID: 0-3637656280
                                                                                                                                                        • Opcode ID: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
                                                                                                                                                        • Instruction ID: efe4a20678031bc524173eeb0d2e1288ac060935f4558c6973bec6d73e9da576
                                                                                                                                                        • Opcode Fuzzy Hash: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
                                                                                                                                                        • Instruction Fuzzy Hash: 85821475E04225CFDB04CF68DC816AEB7B2FF4A311F1981A9D941AB391D739E842CB94
                                                                                                                                                        Function 0041D5AF Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 404encryptionCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1783 41d5af-41d5da call 40c8c0 call 444110 1788 41d5e1-41d60b call 40c8b0 call 4441f0 1783->1788 1789 41d620-41d634 call 403d70 1783->1789 1790 41d650 1783->1790 1791 41d652-41d66b 1783->1791 1792 41d612 1783->1792 1793 41d8b2 1783->1793 1794 41d7b5-41d7bb 1783->1794 1795 41d647-41d64f 1783->1795 1796 41d88d 1783->1796 1797 41d63e-41d644 call 40c8c0 1783->1797 1788->1789 1788->1790 1788->1791 1788->1792 1788->1793 1788->1794 1788->1795 1788->1796 1788->1797 1789->1797 1790->1791 1799 41d670-41d69d 1791->1799 1792->1789 1800 41d7c0-41d7c6 1794->1800 1795->1790 1796->1793 1797->1795 1799->1799 1804 41d69f-41d6ae 1799->1804 1800->1800 1805 41d7c8-41d7e4 1800->1805 1809 41d6b0-41d6bf 1804->1809 1810 41d6ea-41d751 call 4046d0 1804->1810 1811 41d7e6-41d7e9 1805->1811 1812 41d7eb 1805->1812 1814 41d6c0-41d6c7 1809->1814 1825 41d760-41d795 1810->1825 1811->1812 1815 41d7ec-41d803 1811->1815 1812->1815 1817 41d6d0-41d6d6 1814->1817 1818 41d6c9-41d6cc 1814->1818 1819 41d805-41d808 1815->1819 1820 41d80a 1815->1820 1817->1810 1823 41d6d8-41d6e7 call 440d90 1817->1823 1818->1814 1822 41d6ce 1818->1822 1819->1820 1824 41d80b-41d821 call 40c8b0 1819->1824 1820->1824 1822->1810 1823->1810 1833 41d827-41d886 call 4433b0 CryptUnprotectData 1824->1833 1834 41db1a-41db21 1824->1834 1825->1825 1826 41d797-41d7ae call 404810 1825->1826 1826->1793 1826->1794 1826->1796 1833->1796 1839 41dc21-41dc2b 1833->1839 1835 41db48-41db97 call 421a20 * 2 1834->1835 1847 41db99-41dbb0 call 421a20 1835->1847 1848 41db38-41db42 1835->1848 1841 41dc30-41dc39 1839->1841 1841->1841 1843 41dc3b-41dc42 1841->1843 1845 41dd58 1843->1845 1846 41dc48-41dc4d 1843->1846 1849 41dd5b-41dda8 call 40c8b0 1845->1849 1846->1849 1854 41db30-41db34 1847->1854 1855 41dbb6-41dbdf 1847->1855 1848->1833 1848->1835 1858 41ddb0-41dddb 1849->1858 1854->1848 1856 41dbe1-41dbf9 call 421a20 1855->1856 1857 41dc18-41dc1c 1855->1857 1867 41dbfb-41dc0c 1856->1867 1868 41dc0d-41dc13 1856->1868 1857->1848 1858->1858 1860 41dddd-41dded 1858->1860 1861 41de11-41de21 1860->1861 1862 41ddef-41ddf4 1860->1862 1865 41de43 1861->1865 1866 41de23-41de2f 1861->1866 1864 41de00-41de0f 1862->1864 1864->1861 1864->1864 1870 41de46-41de5b call 40d2d0 1865->1870 1869 41de30-41de3f 1866->1869 1867->1868 1868->1848 1869->1869 1871 41de41 1869->1871 1871->1870
                                                                                                                                                        APIs
                                                                                                                                                        • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041D87D
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CryptDataUnprotect
                                                                                                                                                        • String ID: ;:54$J$r
                                                                                                                                                        • API String ID: 834300711-2889753551
                                                                                                                                                        • Opcode ID: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
                                                                                                                                                        • Instruction ID: 1e6a48387384232ca1d9aaf70156626af773b6e64c63cef5257967e80691cf26
                                                                                                                                                        • Opcode Fuzzy Hash: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
                                                                                                                                                        • Instruction Fuzzy Hash: 27D106B5A083409FD724CF24C8917ABB7E1EF96304F04892EE5DA87392D778D941CB96
                                                                                                                                                        Function 00426F82 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 524COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1902 426f82-426f8e 1903 426fe0 1902->1903 1904 426fa0-426faf 1902->1904 1905 426fb6-426fd7 1902->1905 1906 426ed5-426eec 1902->1906 1907 426fe5-426ff7 1902->1907 1903->1907 1904->1903 1904->1905 1904->1906 1904->1907 1905->1903 1906->1904 1908 4270c2-4270d5 1906->1908 1909 426f32-426f3c 1906->1909 1910 426ef3 1906->1910 1911 426f00 1906->1911 1912 426f50-426f58 1906->1912 1913 426f61-426f69 1906->1913 1914 426f06-426f2b 1906->1914 1915 4270f7-427108 1906->1915 1916 426ef9 1906->1916 1917 4270af-4270bb 1906->1917 1918 427000-427024 1907->1918 1908->1915 1919 427162-42716c 1908->1919 1920 4270e0-4270f0 1908->1920 1921 427160 1908->1921 1922 427250-427259 1908->1922 1923 427111-42712a 1908->1923 1924 427131-427138 1908->1924 1925 42713a-42714f 1908->1925 1926 42725b-4272b2 1908->1926 1927 42710f 1908->1927 1928 42748f-427495 1908->1928 1909->1903 1909->1905 1909->1906 1909->1907 1909->1912 1910->1916 1911->1914 1912->1913 1913->1904 1914->1904 1914->1909 1914->1912 1914->1913 1915->1919 1915->1921 1915->1922 1915->1923 1915->1924 1915->1925 1915->1926 1915->1927 1915->1928 1916->1911 1917->1904 1917->1908 1917->1909 1917->1911 1917->1912 1917->1913 1917->1914 1917->1915 1917->1916 1918->1918 1929 427026-42702e 1918->1929 1920->1915 1920->1919 1920->1921 1920->1922 1920->1923 1920->1924 1920->1925 1920->1926 1920->1927 1920->1928 1922->1926 1923->1919 1923->1921 1923->1922 1923->1924 1923->1925 1923->1926 1923->1928 1941 427152-427157 1924->1941 1925->1941 1930 4272c0-4272f5 1926->1930 1927->1923 1933 42749e-4274a6 1928->1933 1931 427034-427042 1929->1931 1932 426ecf 1929->1932 1930->1930 1936 4272f7-42733a 1930->1936 1937 427050-427057 1931->1937 1935 426ed2 1932->1935 1942 4274a8-4274ad 1933->1942 1943 4274af 1933->1943 1935->1906 1951 427343 1936->1951 1952 42733c-427341 1936->1952 1944 427063-427069 1937->1944 1945 427059-42705c 1937->1945 1941->1921 1946 4274b6-427555 call 40c8b0 1942->1946 1943->1946 1944->1935 1949 42706f-4270a8 call 440d90 1944->1949 1945->1937 1948 42705e 1945->1948 1958 427560-427595 1946->1958 1948->1935 1949->1904 1949->1908 1949->1909 1949->1910 1949->1911 1949->1912 1949->1913 1949->1914 1949->1915 1949->1916 1949->1917 1956 427346-42736b call 40c8b0 1951->1956 1952->1956 1969 427374-4273ba call 40c8b0 1956->1969 1970 42736d 1956->1970 1958->1958 1960 427597-4275a3 1958->1960 1961 4275c1-4275d5 1960->1961 1962 4275a5-4275af 1960->1962 1965 4275f1-42760f GetLogicalDrives call 443f40 1961->1965 1966 4275d7-4275da 1961->1966 1964 4275b0-4275bf 1962->1964 1964->1961 1964->1964 1973 427616-42761e 1965->1973 1974 42786b 1965->1974 1967 4275e0-4275ef 1966->1967 1967->1965 1967->1967 1976 4273c0-427407 1969->1976 1970->1969 1973->1974 1977 42786d 1974->1977 1976->1976 1978 427409-427417 1976->1978 1977->1977 1979 427441-42744d 1978->1979 1980 427419-427421 1978->1980 1982 427471-42747b call 443f40 1979->1982 1983 42744f-427452 1979->1983 1981 427430-42743f 1980->1981 1981->1979 1981->1981 1986 427480-427488 1982->1986 1985 427460-42746f 1983->1985 1985->1982 1985->1985 1986->1928 1986->1933
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: ;:54$bqB
                                                                                                                                                        • API String ID: 0-2071309610
                                                                                                                                                        • Opcode ID: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
                                                                                                                                                        • Instruction ID: fa4f063e5c1a2739215ee5b4adf56ea63b9745041435cfc788aeb297095a9e3c
                                                                                                                                                        • Opcode Fuzzy Hash: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
                                                                                                                                                        • Instruction Fuzzy Hash: 6BF144B6E01215CFDB04CF68C8817AEB7B2FF89305F298169D905AB391D779D902CB94
                                                                                                                                                        Function 00440D90 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LdrInitializeThunk.NTDLL(004440E0,005C003F,00000002,00000018,?), ref: 00440DBE
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                        • Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
                                                                                                                                                        • Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
                                                                                                                                                        • Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
                                                                                                                                                        • Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82
                                                                                                                                                        Function 004441F0 Relevance: .2, Instructions: 157COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                        • Opcode ID: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
                                                                                                                                                        • Instruction ID: 3fa07f6db641d71a0473f50ea65704cafb772fe890b3affdcce6dfd07b14b487
                                                                                                                                                        • Opcode Fuzzy Hash: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
                                                                                                                                                        • Instruction Fuzzy Hash: 26414636704300AFE7148B599CC1B3B77A6AFD9B04F19402EEA815B7A1D6B5EC048789
                                                                                                                                                        Function 004413D5 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
                                                                                                                                                        • Instruction ID: 8c003f9823dd69ea712ad3b12e21b48027cbc909d67c67ab34576fa10d6e70ee
                                                                                                                                                        • Opcode Fuzzy Hash: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
                                                                                                                                                        • Instruction Fuzzy Hash: B8212B796083109FE3149F1884D057773A1EB9B329F15163ED592573B2C338AC85DB5E
                                                                                                                                                        Function 0044137E Relevance: .1, Instructions: 57COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
                                                                                                                                                        • Instruction ID: f199c747c52a9adc49da1807b431ea695ec0528af7265f3209bd91b7ed0bd343
                                                                                                                                                        • Opcode Fuzzy Hash: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
                                                                                                                                                        • Instruction Fuzzy Hash: 1801D6386142409BE758DF25D8D18377352E79B358F24193ED193872B1C334A845CB1E
                                                                                                                                                        Function 0040D0B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142threadCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1755 40d0b0-40d0bf 1756 40d0c0-40d0d2 1755->1756 1756->1756 1757 40d0d4-40d0de call 43fad0 1756->1757 1760 40d0e4-40d0eb call 437d30 1757->1760 1761 40d277-40d279 ExitProcess 1757->1761 1764 40d0f1-40d17e GetCurrentThreadId 1760->1764 1765 40d272 call 440ca0 1760->1765 1766 40d180-40d192 1764->1766 1765->1761 1766->1766 1768 40d194-40d197 1766->1768 1769 40d19d-40d1da 1768->1769 1770 40d24f-40d257 GetForegroundWindow 1768->1770 1771 40d1e0-40d1f2 1769->1771 1772 40d259 GetCurrentProcessId 1770->1772 1773 40d25f-40d266 call 40e1c0 1770->1773 1771->1771 1774 40d1f4-40d213 1771->1774 1772->1773 1773->1765 1779 40d268 call 4107e0 1773->1779 1776 40d220-40d234 1774->1776 1776->1776 1778 40d236-40d249 ShellExecuteW 1776->1778 1778->1770 1781 40d26d call 40f960 1779->1781 1781->1765
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 0040D165
                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,81368735,00448050,?,00000000,00000005), ref: 0040D249
                                                                                                                                                        • GetForegroundWindow.USER32(?,00000000,00000005), ref: 0040D24F
                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0040D259
                                                                                                                                                        • ExitProcess.KERNEL32 ref: 0040D279
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentProcess$ExecuteExitForegroundShellThreadWindow
                                                                                                                                                        • String ID: ps
                                                                                                                                                        • API String ID: 1013327911-2817149839
                                                                                                                                                        • Opcode ID: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
                                                                                                                                                        • Instruction ID: 802e53b9b5d3fab858b8c0f51e2b6f1987ae4d254ae5757ddd4a7fa400bb7844
                                                                                                                                                        • Opcode Fuzzy Hash: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
                                                                                                                                                        • Instruction Fuzzy Hash: D14108316183408BE714AB75981536FBBD69FC6314F158D2EE4C1EB2D2CE78C40A8B5A
                                                                                                                                                        Function 004359B7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 1987 4359b7-435a98 call 41c2a0 GetSystemMetrics * 2 1995 435a9f-435b30 1987->1995
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MetricsSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4116985748-3916222277
                                                                                                                                                        • Opcode ID: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
                                                                                                                                                        • Instruction ID: af170d9abb170c5f9c5b4b0cc02af21999a26d1706b44f637ddae32c9d32eadc
                                                                                                                                                        • Opcode Fuzzy Hash: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
                                                                                                                                                        • Instruction Fuzzy Hash: 275180B4E142048FCB40EFACD98169DBBF0BB49300F10856EE898E7350DB74A945CF96
                                                                                                                                                        Function 00440CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79memoryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 2018 440cc0-440cd5 2019 440d50 2018->2019 2020 440d61-440d6a call 43dbb0 2018->2020 2021 440d52-440d5f RtlReAllocateHeap 2018->2021 2022 440cdc-440ce3 2018->2022 2023 440d6c-440d75 call 43dc40 2018->2023 2024 440cea-440d02 2018->2024 2019->2021 2029 440d7a-440d7d 2020->2029 2026 440d77 2021->2026 2022->2019 2022->2021 2022->2023 2022->2024 2023->2026 2025 440d10-440d35 2024->2025 2025->2025 2030 440d37-440d43 2025->2030 2026->2029 2030->2019
                                                                                                                                                        APIs
                                                                                                                                                        • RtlReAllocateHeap.NTDLL(?,00000000,00000000), ref: 00440D59
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID: RD
                                                                                                                                                        • API String ID: 1279760036-1416026120
                                                                                                                                                        • Opcode ID: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
                                                                                                                                                        • Instruction ID: 917b482b4b1a8382910e40b870116946ac0ab3381335ac39e00a72b089b8d08d
                                                                                                                                                        • Opcode Fuzzy Hash: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
                                                                                                                                                        • Instruction Fuzzy Hash: A1018E71D19212CBE314AF75EC8492BBBA5FFCA341F18487DE48057211E634AC19C3EA
                                                                                                                                                        Function 00440F20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 2033 440f20-440f3a 2034 440f40-440f5b 2033->2034 2034->2034 2035 440f5d-440fa7 GetForegroundWindow call 443bb0 2034->2035
                                                                                                                                                        APIs
                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00440F76
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ForegroundWindow
                                                                                                                                                        • String ID: 2123
                                                                                                                                                        • API String ID: 2020703349-208623094
                                                                                                                                                        • Opcode ID: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
                                                                                                                                                        • Instruction ID: dd62e8bd2cb4611141040fdff5c29f2e00b613cfc95a5b2aa94b2229cd067ee0
                                                                                                                                                        • Opcode Fuzzy Hash: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
                                                                                                                                                        • Instruction Fuzzy Hash: CFF028795082804BF310DB29D84122677A1E782319F04893EE5D1C3391C738C9058B0B
                                                                                                                                                        Function 004107F7 Relevance: 2.6, APIs: 2, Instructions: 97COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 004107F9
                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 00410900
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Initialize
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2538663250-0
                                                                                                                                                        • Opcode ID: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
                                                                                                                                                        • Instruction ID: abed82b44eab5e0305b69bf0d3f998583154d3816c8cbfe6d220a5d9129a85a7
                                                                                                                                                        • Opcode Fuzzy Hash: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
                                                                                                                                                        • Instruction Fuzzy Hash: 3A319CF4C10B40AFD770AF3D9A0B6167EB4AB06650F504B1DF8E6966D4E330A4198BD7
                                                                                                                                                        Function 0040E1C0 Relevance: 1.6, APIs: 1, Instructions: 90libraryCOMMON
                                                                                                                                                        Download Yara Rule

                                                                                                                                                        Control-flow Graph

                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        control_flow_graph 2422 40e1c0-40e1f7 2423 40e200-40e220 2422->2423 2423->2423 2424 40e222-40e25b 2423->2424 2425 40e260-40e27c 2424->2425 2425->2425 2426 40e27e-40e296 LoadLibraryExW call 43f7a0 2425->2426 2429 40e2a1-40e2e4 call 4433b0 * 3 2426->2429 2430 40e29d-40e29f 2426->2430 2431 40e2f1-40e2fb 2429->2431 2430->2431
                                                                                                                                                        APIs
                                                                                                                                                        • LoadLibraryExW.KERNEL32(611D67ED,00000000,E3E2F9E0), ref: 0040E286
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LibraryLoad
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1029625771-0
                                                                                                                                                        • Opcode ID: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
                                                                                                                                                        • Instruction ID: d211cc36a776a4650d6a25cec4ad6f3432bf0b80887fe1339dfabb32a98ff728
                                                                                                                                                        • Opcode Fuzzy Hash: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
                                                                                                                                                        • Instruction Fuzzy Hash: 86214478508380DBD314DF26ED426AF7BA1FBD6304F448C7EE18467253E739490A87AA
                                                                                                                                                        Function 0043DC40 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043DCCD
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FreeHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3298025750-0
                                                                                                                                                        • Opcode ID: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
                                                                                                                                                        • Instruction ID: 9a37441ecb8038b1869d6f0b088ecbbae8f0e36ee8fdc8f39d9be2bbcf67dc69
                                                                                                                                                        • Opcode Fuzzy Hash: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
                                                                                                                                                        • Instruction Fuzzy Hash: 470197BB65C3584FC7006F91EC986A6BBA4EFD1304F04403DD68046742DAFB6919C742
                                                                                                                                                        Function 00431859 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BlanketProxy
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3890896728-0
                                                                                                                                                        • Opcode ID: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
                                                                                                                                                        • Instruction ID: 3c9e977c450c4f135c35c7a6bcfc28f59b32f7b5f649b834322db586f9a604c7
                                                                                                                                                        • Opcode Fuzzy Hash: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
                                                                                                                                                        • Instruction Fuzzy Hash: E9F074B12097029FE311DF65C5A574BBBE5BB81304F10891CE4E54B290C7B9A6498FC2
                                                                                                                                                        Function 00434A7F Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BlanketProxy
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3890896728-0
                                                                                                                                                        • Opcode ID: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
                                                                                                                                                        • Instruction ID: c572d4cf98657ec48b104726610bbd336e2b736b7c73d1d011650ea931ce08df
                                                                                                                                                        • Opcode Fuzzy Hash: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
                                                                                                                                                        • Instruction Fuzzy Hash: A8F022B450D341DFE721DF29C5A871ABBE0BB85344F118A1CE4988B290D7B995498F82
                                                                                                                                                        Function 00440F68 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00440F76
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ForegroundWindow
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2020703349-0
                                                                                                                                                        • Opcode ID: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
                                                                                                                                                        • Instruction ID: 1d22e8fd700c48bebeffbf26d2c2cf474de0d3d9f3e244df8e013e987bfa5a4a
                                                                                                                                                        • Opcode Fuzzy Hash: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
                                                                                                                                                        • Instruction Fuzzy Hash: 04E08C7D6102408FE604DF25EC9142537A4F70B20A700083EE583D3362DF35E640CB0A
                                                                                                                                                        Function 0043A952 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043A965
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: BlanketProxy
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3890896728-0
                                                                                                                                                        • Opcode ID: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
                                                                                                                                                        • Instruction ID: 08e963fcd4019adc8e60d466b8283255b1915ff9cc04a16a63baa1f472e6b219
                                                                                                                                                        • Opcode Fuzzy Hash: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
                                                                                                                                                        • Instruction Fuzzy Hash: A8D09234381700ABE2318B14EC56F15B3A1BB4AF02F204458F7866F9E0CAF1BA118B08
                                                                                                                                                        Function 0043DC18 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043DC24
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                        • Opcode ID: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
                                                                                                                                                        • Instruction ID: ca62b0fe6bc361b8fe52465035c8e03aaa158e12bb5b8da0d05e115494f84301
                                                                                                                                                        • Opcode Fuzzy Hash: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
                                                                                                                                                        • Instruction Fuzzy Hash: 46B01234146110B8D03117120CC5FFFAD7CBF43F99F102014B204240C00754A001D07D

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 00435210 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 120clipboardCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Clipboard$CloseDataLongOpenWindow
                                                                                                                                                        • String ID: I$K$L$N$V$V$X$Y$Y$]$_$q
                                                                                                                                                        • API String ID: 1647500905-2073889574
                                                                                                                                                        • Opcode ID: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
                                                                                                                                                        • Instruction ID: 5f54679d46b1477f2188d147cccf107156d33419d86dcd770f9b8ea5c9be5ebf
                                                                                                                                                        • Opcode Fuzzy Hash: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
                                                                                                                                                        • Instruction Fuzzy Hash: 59419F7150C781CFE300AF78D48836FBFD0AB96358F04486EE9C986382D6BD8548876B
                                                                                                                                                        Function 0041F510 Relevance: 24.0, Strings: 18, Instructions: 1543COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $!by*$$$)*+$$123X$1X74$45$5670$;:54$=n=c$H$PQRS$Xqrs$\]^_$`abc$eyv$sDK}$vv@
                                                                                                                                                        • API String ID: 0-744883782
                                                                                                                                                        • Opcode ID: c229f77fb4dde2aeda0d8500a780d2b96b94c98019c88d2c63e43e3da62988bc
                                                                                                                                                        • Instruction ID: 1b15bb1a847ad30610cce9acb8caa6647067d7ad15c9c1d0ffbf0153a392e0ce
                                                                                                                                                        • Opcode Fuzzy Hash: c229f77fb4dde2aeda0d8500a780d2b96b94c98019c88d2c63e43e3da62988bc
                                                                                                                                                        • Instruction Fuzzy Hash: 93B2D1706083918FD735CF25D8907ABBBE1AFD6304F58892EE4C98B392D7788449CB56
                                                                                                                                                        Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
                                                                                                                                                        • API String ID: 0-3131871939
                                                                                                                                                        • Opcode ID: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
                                                                                                                                                        • Instruction ID: 82a1047e918a4e78821797639cc0c6063c4209a2a2cc243c20951bfdc3e4a492
                                                                                                                                                        • Opcode Fuzzy Hash: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
                                                                                                                                                        • Instruction Fuzzy Hash: 0DE2D2716083418FC718CF28C49436BBBE2AF95314F18867EE495AB3D1D778D949CB8A
                                                                                                                                                        Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
                                                                                                                                                        • API String ID: 0-3385986306
                                                                                                                                                        • Opcode ID: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
                                                                                                                                                        • Instruction ID: 43567f08c2414d3a819ad9695f197ad83829e26c61288a5e6a0b7cb6c91f239b
                                                                                                                                                        • Opcode Fuzzy Hash: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
                                                                                                                                                        • Instruction Fuzzy Hash: 8282D5756093418FC719CF28C69431ABBE1AB85304F18896EE8D5A73D1D3B8DD05CB8A
                                                                                                                                                        Function 0042AA40 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 523COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: 3L,S$;:54$D4'2$gw$t|
                                                                                                                                                        • API String ID: 0-148604455
                                                                                                                                                        • Opcode ID: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
                                                                                                                                                        • Instruction ID: 33cda5058ecfcda83a8ae49a4051d765de37c74bc4d0c890624df7c0bc77531d
                                                                                                                                                        • Opcode Fuzzy Hash: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
                                                                                                                                                        • Instruction Fuzzy Hash: 99F122B66083508FD3249F25D88166BBBE1FFC6315F448A2DE5C59B391D7788901CB86
                                                                                                                                                        Function 0041ECDE Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 521COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID: ;:54$;:54$;:54$;:54$;:54
                                                                                                                                                        • API String ID: 2994545307-1306776023
                                                                                                                                                        • Opcode ID: a1c4bc155694037db096d5376c81496c1941f374db6816183eda17924910fa6e
                                                                                                                                                        • Instruction ID: 7a1c93435aac4f4fc6971621666823cbdd623ae048940ead9436b97a0d7840c7
                                                                                                                                                        • Opcode Fuzzy Hash: a1c4bc155694037db096d5376c81496c1941f374db6816183eda17924910fa6e
                                                                                                                                                        • Instruction Fuzzy Hash: F1F12C37648340DBD724CB14D8816BBB7A6EB8B704F18493DDAC657752D339DC828B8A
                                                                                                                                                        Function 0040D500 Relevance: 10.2, Strings: 8, Instructions: 218COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: &%9b$)vBW$*#1/$9&!:$s$>%$sp$.$x$x|."
                                                                                                                                                        • API String ID: 0-2964809603
                                                                                                                                                        • Opcode ID: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
                                                                                                                                                        • Instruction ID: 0245b1b87f528dc33afc8e654017f442f228954418cf843cd2d284c2b8725095
                                                                                                                                                        • Opcode Fuzzy Hash: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
                                                                                                                                                        • Instruction Fuzzy Hash: E451E17450D3C08BD315CF2994A07ABBFE0AF93305F1899ADE4D55B391D27A880ECB66
                                                                                                                                                        Function 00507420 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 281COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • std::_Xinvalid_argument.LIBCPMT ref: 0050772C
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Xinvalid_argumentstd::_
                                                                                                                                                        • String ID: vector too long$xu%|$xu%|$xu%|
                                                                                                                                                        • API String ID: 909987262-2952769458
                                                                                                                                                        • Opcode ID: 07b6b37315ec8c9c0dc43ec2e9b273b2d1b6f523e3d0c35cc9b34291fee86374
                                                                                                                                                        • Instruction ID: a86e84b3caeeeb8b54e5f6be3b8719197a9be13443865b36d0e1259bcd52ad23
                                                                                                                                                        • Opcode Fuzzy Hash: 07b6b37315ec8c9c0dc43ec2e9b273b2d1b6f523e3d0c35cc9b34291fee86374
                                                                                                                                                        • Instruction Fuzzy Hash: 3671473BFA55100BEB1888798C9A3D767C347D5314F1BE43A4989D7281ECAF5C4A5B80
                                                                                                                                                        Function 004241E0 Relevance: 8.0, Strings: 6, Instructions: 461COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: GB$){zy$)6$)B$|~$sq
                                                                                                                                                        • API String ID: 0-1292531311
                                                                                                                                                        • Opcode ID: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
                                                                                                                                                        • Instruction ID: 71584c7dd643340a7c9b4b8dcbaefec527e76613856c743693e70a6483ef5efc
                                                                                                                                                        • Opcode Fuzzy Hash: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
                                                                                                                                                        • Instruction Fuzzy Hash: E1C123B16083208BD724DF25E85276BB7F1EFD2354F588A1DE4D58B390EB389805CB96
                                                                                                                                                        Function 0052BA90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: eb53c55c443de7508ee645b653adc9b5bf38fd51a121fd7e01578c595efa0f76
                                                                                                                                                        • Instruction ID: 0ab3516b638c39718b580db9c8ec25413d311520ff6ad09ae65e8f812d99a872
                                                                                                                                                        • Opcode Fuzzy Hash: eb53c55c443de7508ee645b653adc9b5bf38fd51a121fd7e01578c595efa0f76
                                                                                                                                                        • Instruction Fuzzy Hash: 5E025C71E002299BEF14CFA8D8807EEBBB5FF49314F258269E515A7381D731AE41CB80
                                                                                                                                                        Function 0041E298 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FindWindowExW.USER32(00000000,?,A3D19DEA,00000000), ref: 0041E410
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FindWindow
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 134000473-0
                                                                                                                                                        • Opcode ID: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
                                                                                                                                                        • Instruction ID: 8cc40bb880943b3fdd4a09bf692fc47349ab873484ee8d2c9c2d8e6455f3c944
                                                                                                                                                        • Opcode Fuzzy Hash: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
                                                                                                                                                        • Instruction Fuzzy Hash: 21D1E2796083518FC725CF29D84069FBBE2EFC9308F08896EE4859B391DB74D945CB86
                                                                                                                                                        Function 00526378 Relevance: 6.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00526468
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                        • Opcode ID: 5fa66669e9684112d3f38ee6a75e977b217276935ea74b68e9b037c3eef6ea4c
                                                                                                                                                        • Instruction ID: 6e608dec6f40ee5e6c41c36b0330c1c5f11ce6533ed82073435364c406d004a1
                                                                                                                                                        • Opcode Fuzzy Hash: 5fa66669e9684112d3f38ee6a75e977b217276935ea74b68e9b037c3eef6ea4c
                                                                                                                                                        • Instruction Fuzzy Hash: A971F2B19051799FDF20EF24AC9DAAEBFB9BF46300F5441D9E04893291EA318E859F50
                                                                                                                                                        Function 0051B644 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0051B650
                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 0051B71C
                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B73C
                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(?), ref: 0051B746
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 254469556-0
                                                                                                                                                        • Opcode ID: fd0a53087488cb679fdb108ff33b9f726fedf2d1ec94802b9519cdda0f7db4f3
                                                                                                                                                        • Instruction ID: 0c4b5d6df672580a799f27f9ec93a4a6b13282fded62735cb999c1f15967212e
                                                                                                                                                        • Opcode Fuzzy Hash: fd0a53087488cb679fdb108ff33b9f726fedf2d1ec94802b9519cdda0f7db4f3
                                                                                                                                                        • Instruction Fuzzy Hash: AB313AB5D4521D9BEB21DF64D9897CDBBB8BF08300F10419AE40DA7250EB715B889F44
                                                                                                                                                        Function 00428F00 Relevance: 5.5, Strings: 4, Instructions: 489COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: ;:54$HyJ{$TeVg$pq
                                                                                                                                                        • API String ID: 0-3800776496
                                                                                                                                                        • Opcode ID: b59a32591fe918d7366cfb9ad6e33efc92948c6b11b36bca78c2caa055b05ea7
                                                                                                                                                        • Instruction ID: 937f9a8cfd1e2d128634e98be9aa3ff82b67fd992892cbc4a13105e05eec71b6
                                                                                                                                                        • Opcode Fuzzy Hash: b59a32591fe918d7366cfb9ad6e33efc92948c6b11b36bca78c2caa055b05ea7
                                                                                                                                                        • Instruction Fuzzy Hash: 9BF10176A093628BC320CF24C8806AFB3A2FFC5744F59886DD4C55B324DB749946DB8A
                                                                                                                                                        Function 00442EB0 Relevance: 4.8, Strings: 3, Instructions: 1010COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "5D$@3D$G3D
                                                                                                                                                        • API String ID: 0-1898335559
                                                                                                                                                        • Opcode ID: ca7d18b9f0ece28521e7f188a6aa14edef678a902b8fcebda9fba9b38294a369
                                                                                                                                                        • Instruction ID: ce56d9e6797e6fc455282548f9e4f7f68bba8f0454dcdd091ad8ff22b9dad6c1
                                                                                                                                                        • Opcode Fuzzy Hash: ca7d18b9f0ece28521e7f188a6aa14edef678a902b8fcebda9fba9b38294a369
                                                                                                                                                        • Instruction Fuzzy Hash: CD62F039A04211CFDB08CF68D8916AEB7F2FB8A315F19817ED846A7395D734AD05CB84
                                                                                                                                                        Function 004431D0 Relevance: 4.4, Strings: 3, Instructions: 680COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "5D$@3D$G3D
                                                                                                                                                        • API String ID: 0-1898335559
                                                                                                                                                        • Opcode ID: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
                                                                                                                                                        • Instruction ID: 0d27d5ca0624dddcec474f96472bfb5c1ea38ed4ad0558f269f9c7dbbb12b3c7
                                                                                                                                                        • Opcode Fuzzy Hash: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
                                                                                                                                                        • Instruction Fuzzy Hash: BF12FF39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DC946A7352D335AD06CB84
                                                                                                                                                        Function 00421B40 Relevance: 4.4, Strings: 3, Instructions: 657COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID: ;:54$;:54$s}
                                                                                                                                                        • API String ID: 2994545307-2837035532
                                                                                                                                                        • Opcode ID: 9df98e736ffcd3d527ee05afaf5ce9d017e9f9254f793c40ca85cc5ce89bb78d
                                                                                                                                                        • Instruction ID: 663f8f0829c23ecb73308a959951e136473ffcabccf44f1e6a246336cf4c5ef0
                                                                                                                                                        • Opcode Fuzzy Hash: 9df98e736ffcd3d527ee05afaf5ce9d017e9f9254f793c40ca85cc5ce89bb78d
                                                                                                                                                        • Instruction Fuzzy Hash: 2E2220716083509BE720CF25D981B6FB7E2FBC5704F54882EEA859B391D778E801CB5A
                                                                                                                                                        Function 004432C0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "5D$@3D$G3D
                                                                                                                                                        • API String ID: 0-1898335559
                                                                                                                                                        • Opcode ID: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
                                                                                                                                                        • Instruction ID: f5333144ef70c2a173cc619d7536ed6f405604b094df42d2374a6f5ff99be012
                                                                                                                                                        • Opcode Fuzzy Hash: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
                                                                                                                                                        • Instruction Fuzzy Hash: 2C020F39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DD846A7342D335AD06CB94
                                                                                                                                                        Function 0042AC04 Relevance: 4.3, Strings: 3, Instructions: 578COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: SRP\$TU$YB]G
                                                                                                                                                        • API String ID: 0-3716301176
                                                                                                                                                        • Opcode ID: 5bb14eefcdfe82c0fe0139c8d462f47c3a2ca31c9906138fdde2f92c6f65c02a
                                                                                                                                                        • Instruction ID: 2ab5dbaa93f2d707f6f6e66add1144ac258b2aec8bad53236f1827fb2ff53458
                                                                                                                                                        • Opcode Fuzzy Hash: 5bb14eefcdfe82c0fe0139c8d462f47c3a2ca31c9906138fdde2f92c6f65c02a
                                                                                                                                                        • Instruction Fuzzy Hash: 560236B5608351CFC7049F25D89126BB7E2EFD6305F08892EE8C597391E378D906CB9A
                                                                                                                                                        Function 0040E8D6 Relevance: 3.8, Strings: 3, Instructions: 52COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: %!-0$:g;1$j
                                                                                                                                                        • API String ID: 0-565037024
                                                                                                                                                        • Opcode ID: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
                                                                                                                                                        • Instruction ID: 32df4f5ca928b1c4db86954fec2fd0b7d1b741fb7c4248b2e7c729c7ce3ce05b
                                                                                                                                                        • Opcode Fuzzy Hash: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
                                                                                                                                                        • Instruction Fuzzy Hash: D111BFB0209380CBC3558F3A945052BFBE0EB82708F585E6DE0D27B391D374CD1A9B4A
                                                                                                                                                        Function 0040E996 Relevance: 3.8, Strings: 3, Instructions: 25COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: %!-0$:g;1$j
                                                                                                                                                        • API String ID: 0-565037024
                                                                                                                                                        • Opcode ID: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
                                                                                                                                                        • Instruction ID: 596850defd4a036336a324cb21a7a3242656b73628fcb9d0064f5a2a21d3f7d4
                                                                                                                                                        • Opcode Fuzzy Hash: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
                                                                                                                                                        • Instruction Fuzzy Hash: A8F044A00083408BC7018F29955141BFFE0FB96218F806E2CE0E67B282D3B4C60A8B4B
                                                                                                                                                        Function 004433B0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "5D
                                                                                                                                                        • API String ID: 0-386403491
                                                                                                                                                        • Opcode ID: 35056113c60dbd41f8426ba1490496434605cc7e9e6b29d771693653d0998dbf
                                                                                                                                                        • Instruction ID: d7a0add943f148724df6d99197c8bd1c248c42391e822a4ab72d2176c05d2b00
                                                                                                                                                        • Opcode Fuzzy Hash: 35056113c60dbd41f8426ba1490496434605cc7e9e6b29d771693653d0998dbf
                                                                                                                                                        • Instruction Fuzzy Hash: 1D02F135A05215CFDB18CF68D8906AEB7F2FB8A315F19807EC846A7342D735AD06CB94
                                                                                                                                                        Function 00425F00 Relevance: 1.8, APIs: 1, Instructions: 251comCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • CoCreateInstance.OLE32(004479D8,00000000,00000001,004479C8), ref: 00425F29
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CreateInstance
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 542301482-0
                                                                                                                                                        • Opcode ID: 6e3a031c0afa7cf2364f65541825ecbcb683ae6c1c017608a85ef565e3a7ea66
                                                                                                                                                        • Instruction ID: eec0e6367e40af910e4f38a67743c5664d32b682df124dc662bb51fbbca82cfa
                                                                                                                                                        • Opcode Fuzzy Hash: 6e3a031c0afa7cf2364f65541825ecbcb683ae6c1c017608a85ef565e3a7ea66
                                                                                                                                                        • Instruction Fuzzy Hash: F861CDB13002209BDB20DB24DC92B7733A4EF85758F458559FA46CB391E779E801C76A
                                                                                                                                                        Function 0042E400 Relevance: 1.6, Strings: 1, Instructions: 382COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "
                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                        • Opcode ID: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
                                                                                                                                                        • Instruction ID: 68251316c82459e1b79cf8655833eab7d307529819052df6cdad143cf461d429
                                                                                                                                                        • Opcode Fuzzy Hash: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
                                                                                                                                                        • Instruction Fuzzy Hash: 48C13AB2B043205BD714DE26E49076BB7E5AF84354F98892FE89587382E73CEC44C796
                                                                                                                                                        Function 00421333 Relevance: 1.5, Strings: 1, Instructions: 288COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: US
                                                                                                                                                        • API String ID: 0-1549774597
                                                                                                                                                        • Opcode ID: 40c57cd8e3745a142ea7a9c493a00c5e26e3ea1eaa4ddc22655fa54c1efa7ee4
                                                                                                                                                        • Instruction ID: 3024a2b3aec96dee861537dac0de769f6ce30434eb834ac09468a51a814e571a
                                                                                                                                                        • Opcode Fuzzy Hash: 40c57cd8e3745a142ea7a9c493a00c5e26e3ea1eaa4ddc22655fa54c1efa7ee4
                                                                                                                                                        • Instruction Fuzzy Hash: BD818EB1A00215CBCB10CF64D8926B7B3B0FF55364F18815AD8566F7A1E339D912CB98
                                                                                                                                                        Function 0043F7E0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID: InA>
                                                                                                                                                        • API String ID: 2994545307-2903657838
                                                                                                                                                        • Opcode ID: e049606c169951e19221e3ad5ade3226a053a4dbaa04318920fabf1709692af5
                                                                                                                                                        • Instruction ID: 67eb01b019c0e27b89a240b1cc11858b2d7ab5932ea24ba076d86815e27896ea
                                                                                                                                                        • Opcode Fuzzy Hash: e049606c169951e19221e3ad5ade3226a053a4dbaa04318920fabf1709692af5
                                                                                                                                                        • Instruction Fuzzy Hash: 14710872A083016FD718DE28C884B3BBBE2AFC8314F14953EE99587355D679DC09978A
                                                                                                                                                        Function 0042E870 Relevance: 1.5, Strings: 1, Instructions: 236COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: "
                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                        • Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                        • Instruction ID: b5b56033d86e36a5a2f775e18004cfca431a6ac7bf94099ec4257ac67d618ec2
                                                                                                                                                        • Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                        • Instruction Fuzzy Hash: 80710D32B083354BD714CE2AD48031FBBE2ABC5710F99896FE4D597351D639EC45878A
                                                                                                                                                        Function 0042CEDA Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID: ;:54
                                                                                                                                                        • API String ID: 0-2887251705
                                                                                                                                                        • Opcode ID: d320a364d458c4f12b5ab96ddb1ec6b204cae623072d35a93d7e27a7fe08aee9
                                                                                                                                                        • Instruction ID: a6f6f25a51f5e52a44388338aa3e144efc2bcfc1fab5ec9bc31da552ce81e20e
                                                                                                                                                        • Opcode Fuzzy Hash: d320a364d458c4f12b5ab96ddb1ec6b204cae623072d35a93d7e27a7fe08aee9
                                                                                                                                                        • Instruction Fuzzy Hash: BB01BC357083009BE7188F10A9C163BB363EB96354F29986ED58927656C378DC468B9A
                                                                                                                                                        Function 00441720 Relevance: .5, Instructions: 497COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 59b1c0f5a7b546f4d153a417e5f5d0868e70a01fca9bbb907ba0b13a7a0d58b8
                                                                                                                                                        • Instruction ID: 54dc22799c33e5f30e9c08018129e0ce983c2b02d0a70579d262adcf57ac8fca
                                                                                                                                                        • Opcode Fuzzy Hash: 59b1c0f5a7b546f4d153a417e5f5d0868e70a01fca9bbb907ba0b13a7a0d58b8
                                                                                                                                                        • Instruction Fuzzy Hash: 49F13536A08395CFC314CF39D89012AB7E2FB8A311F19867DD99587392E739E941CB45
                                                                                                                                                        Function 00443720 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 60ff9693df6bf70c0841e9182befa73d77b127f566fea254279336c35b952eb2
                                                                                                                                                        • Instruction ID: 1bb81eb731d0dcd2e931e8a05a9d9ebd5cbd5509060ea70f8d3fa45d3e7787eb
                                                                                                                                                        • Opcode Fuzzy Hash: 60ff9693df6bf70c0841e9182befa73d77b127f566fea254279336c35b952eb2
                                                                                                                                                        • Instruction Fuzzy Hash: ADA1FF39A05215CFDB08CF68D8902AEB7F2FF8A315F19847DC946A7741D335AA06CB94
                                                                                                                                                        Function 0042CA72 Relevance: .3, Instructions: 318COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
                                                                                                                                                        • Instruction ID: 675397662e7d35c3e988c68934b2adc1cfbc6c7944ee00e9ec449aaad2b39987
                                                                                                                                                        • Opcode Fuzzy Hash: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
                                                                                                                                                        • Instruction Fuzzy Hash: 32911271A483258BD320EF55D89172BB3A1FFD1354F48892EE8C54B390E778D905CB9A
                                                                                                                                                        Function 00405820 Relevance: .2, Instructions: 163COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
                                                                                                                                                        • Instruction ID: 6fa81707170a7b0eec34b7c549ef7d1de648c0191335202d19104e511ca05f9f
                                                                                                                                                        • Opcode Fuzzy Hash: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
                                                                                                                                                        • Instruction Fuzzy Hash: CB51C0B5A042009FC714EF18D880927B7A1FF84328F19467EE899AB392D735EC51CF95
                                                                                                                                                        Function 00444380 Relevance: .2, Instructions: 154COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                        • Opcode ID: b30be3330aa3a9b0776dd9b3a63c4cc084a984c5573858b65a5c04746aedeb5a
                                                                                                                                                        • Instruction ID: d8175d673cc7335d824d045451b58485fcddcae10ae5620f16eb342d1db79df6
                                                                                                                                                        • Opcode Fuzzy Hash: b30be3330aa3a9b0776dd9b3a63c4cc084a984c5573858b65a5c04746aedeb5a
                                                                                                                                                        • Instruction Fuzzy Hash: 73415839744300AFF7248B58DCC1B3BB7A6EBD9704F29402DE6815B7A1D675AC00C78A
                                                                                                                                                        Function 0043B170 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
                                                                                                                                                        • Instruction ID: a6169620d5a1696827cd8f84d74400514db1317b9fd11854ebdf9f64215e6560
                                                                                                                                                        • Opcode Fuzzy Hash: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
                                                                                                                                                        • Instruction Fuzzy Hash: D8314A76B043046BE710A9659C85F3B729ADBC8758F04057EFE4493252F739EC0183E6
                                                                                                                                                        Function 0041C6E0 Relevance: .1, Instructions: 128COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 69b715797aa34ff3df19708ed0b662cc76d9dc44af87f24b806e805beb1256d6
                                                                                                                                                        • Instruction ID: ab10e966be47ece3002b41b3827003e7ca7586d7d52b0e385e3b598e06569719
                                                                                                                                                        • Opcode Fuzzy Hash: 69b715797aa34ff3df19708ed0b662cc76d9dc44af87f24b806e805beb1256d6
                                                                                                                                                        • Instruction Fuzzy Hash: EA4106745453019BD3249F14CC82BE7B7E4EF86721F004A29F9959B3D1E3B8D941CBAA
                                                                                                                                                        Function 0040C960 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
                                                                                                                                                        • Instruction ID: 6806c5bbc4d6b822e97fdcaec603f9dae13aeb23598a5c10dbecc01c31c55fc2
                                                                                                                                                        • Opcode Fuzzy Hash: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
                                                                                                                                                        • Instruction Fuzzy Hash: D9317A299492E586C332CA3D84E016EBF906D972247A943FFCCF11F3C3C556898687E5
                                                                                                                                                        Function 0041C8CE Relevance: .1, Instructions: 94COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
                                                                                                                                                        • Instruction ID: 561eeec7ef4372a3df09e76981c1185a624b11daafb68e3f07fe16c596ccf13b
                                                                                                                                                        • Opcode Fuzzy Hash: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
                                                                                                                                                        • Instruction Fuzzy Hash: 733191B15483408BC7349F14C8923EBB7B1FFA6354F14991DE4C95B391E3788981CB9A
                                                                                                                                                        Function 00437CA0 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                        • Instruction ID: 6ade34961fb6eb55b73b66c7245ba825150ca2b3c80ec9725d78a0205780844b
                                                                                                                                                        • Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                        • Instruction Fuzzy Hash: BD11E973A091D80EC3268D3C8400575BFA31B97635F19639AF4F59B2D2D6268D8B8359
                                                                                                                                                        Function 00440E3A Relevance: .1, Instructions: 64COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: dc57866d1e81e6a0e886b15dfe649725a339f2de6721dcbe9a3cdc7b8a74282c
                                                                                                                                                        • Instruction ID: 124000ce79dcdd71ba2bb92ad96e4b748c8b16b76f27859204af7460fe27bfba
                                                                                                                                                        • Opcode Fuzzy Hash: dc57866d1e81e6a0e886b15dfe649725a339f2de6721dcbe9a3cdc7b8a74282c
                                                                                                                                                        • Instruction Fuzzy Hash: 24118F386056408FC70CDB28D47162FBAB2FB96205F94997EE193D7B64C7389412DB4A
                                                                                                                                                        Function 0042DE70 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: f84c3b131bcf499d63e6b80aa2f1beace20ffa960dffd1ad22babe7e1f8cb60c
                                                                                                                                                        • Instruction ID: d66ca4475af4d35a29a52c68c2a69bee92f31811c60477103741a86aac2cde38
                                                                                                                                                        • Opcode Fuzzy Hash: f84c3b131bcf499d63e6b80aa2f1beace20ffa960dffd1ad22babe7e1f8cb60c
                                                                                                                                                        • Instruction Fuzzy Hash: 8F01B5F2B00B1187D720AF51A4C0727B3A96FA0708F59413ED4055B342DB79EC08C39D
                                                                                                                                                        Function 0043FAD0 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
                                                                                                                                                        • Instruction ID: 58e8886864d4165c492f53d94ac2ec571c49354c70431e2038b14aa9fdf686d5
                                                                                                                                                        • Opcode Fuzzy Hash: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
                                                                                                                                                        • Instruction Fuzzy Hash: 901101B4A193804FD784DF25D89052BBAB4EB8A348F88AC2CE492E7350D738D5028F06
                                                                                                                                                        Function 00432088 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
                                                                                                                                                        • Instruction ID: 73ba8bc07e1ba15521088f6cccb2f0558f02181132062fbfe265993b15d3b92d
                                                                                                                                                        • Opcode Fuzzy Hash: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
                                                                                                                                                        • Instruction Fuzzy Hash: 6A11E0B45087408FD750DF28C48878ABBE0FB09304F1488ADE899CB346D77AE58ACB91
                                                                                                                                                        Function 0042AA60 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
                                                                                                                                                        • Instruction ID: ca966f37c3a7dbe55b207b2fb1d7652738fa600dc0873f2892cf3005b09500ed
                                                                                                                                                        • Opcode Fuzzy Hash: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
                                                                                                                                                        • Instruction Fuzzy Hash: 6501BCB090D3849BD3449F65C8A571BFFE4AB82318F906D2DF1E28B290C7B98409CF56
                                                                                                                                                        Function 00441648 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: fd8a8fe6d65e0ef33865518a253835d798b8716f646b673b848b87c0ad7caa14
                                                                                                                                                        • Instruction ID: dea776a36a39075b24f8f6c16698ee402748b83085f9428075cd22d80d1f5197
                                                                                                                                                        • Opcode Fuzzy Hash: fd8a8fe6d65e0ef33865518a253835d798b8716f646b673b848b87c0ad7caa14
                                                                                                                                                        • Instruction Fuzzy Hash: 78F0A0B6C0A3908FD304DF22D5154A7BAA3ABEA611F56D93CC5D1ABB50CB359800DBC7
                                                                                                                                                        Function 0043C6D0 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
                                                                                                                                                        • Instruction ID: f7bff9853d72cc689f6dce1b47a59223474ca62ca5c62c8c45c1f9517843fa2b
                                                                                                                                                        • Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
                                                                                                                                                        • Instruction Fuzzy Hash: 2DD05E2160862146AB648E29A44197BF7E0EA8BB11F49A55FF582F3248D234DC41D2AD
                                                                                                                                                        Function 0051AD82 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0051AD96
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0051ADA4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0051ADB5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0051ADC6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0051ADD7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0051ADE8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0051ADF9
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0051AE0A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0051AE1B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0051AE2C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0051AE3D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0051AE4E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0051AE5F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0051AE70
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0051AE81
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0051AE92
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0051AEA3
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0051AEB4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0051AEC5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0051AED6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0051AEE7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0051AEF8
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0051AF09
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0051AF1A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0051AF2B
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0051AF3C
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0051AF4D
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0051AF5E
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0051AF6F
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0051AF80
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0051AF91
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0051AFA2
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0051AFB3
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0051AFC4
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0051AFD5
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0051AFE6
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0051AFF7
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0051B008
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0051B019
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0051B02A
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0051B03B
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                        • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                                                                                        • API String ID: 667068680-295688737
                                                                                                                                                        • Opcode ID: 3f4110005ec394cecff0116888c9302d0070edc1edc0c67fac52fd52359f8e92
                                                                                                                                                        • Instruction ID: 09bf8c714df9f498236de3ac7a1366a4f470d9f98e3a90b7fa6d837dc0a394d7
                                                                                                                                                        • Opcode Fuzzy Hash: 3f4110005ec394cecff0116888c9302d0070edc1edc0c67fac52fd52359f8e92
                                                                                                                                                        • Instruction Fuzzy Hash: EC61AAB2D56B14BBCB119FB4AE4D85A3FA8FA3D7027001456B142E2762E7B44088FF91
                                                                                                                                                        Function 004344AC Relevance: 52.7, APIs: 1, Strings: 29, Instructions: 163memoryCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AllocString
                                                                                                                                                        • String ID: 0$A$C$E$E$E$G$I$L$M$O$V$X$a$c$d$e$g$i$k$m$o$q$s$u$w$y${$}
                                                                                                                                                        • API String ID: 2525500382-1585318030
                                                                                                                                                        • Opcode ID: 1725aad4737aaae7f317832f14c23f5d8215ec4c0be4ffa9d4f1ac8590fd715f
                                                                                                                                                        • Instruction ID: bc8319635e7ec1087d55e7204a5246f8d78f84ad8ba8ba7a2beea8eaa9d0cc59
                                                                                                                                                        • Opcode Fuzzy Hash: 1725aad4737aaae7f317832f14c23f5d8215ec4c0be4ffa9d4f1ac8590fd715f
                                                                                                                                                        • Instruction Fuzzy Hash: 8291096150DBC18AE332C73C880879BBED12BA7224F188B9DD5ED9B2D2C7B90445D767
                                                                                                                                                        Function 004340F6 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 104COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                        • String ID: @$A$C$E$G$I$K$M$O$q$s$u$w$y
                                                                                                                                                        • API String ID: 1927566239-3739842773
                                                                                                                                                        • Opcode ID: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
                                                                                                                                                        • Instruction ID: cfa59d3dd61b8fc2c8280ba4920ca822f29ebbc03a68f38a0becb94220d4ac66
                                                                                                                                                        • Opcode Fuzzy Hash: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
                                                                                                                                                        • Instruction Fuzzy Hash: 8A51247150C7D08AE325CB28845879FBFD16BE6324F184A9DE4E94B3E2C7B88845C767
                                                                                                                                                        Function 004342D4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 94COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                        • String ID: !$($-$-$2$3$7$8$=$?
                                                                                                                                                        • API String ID: 2610073882-1101923984
                                                                                                                                                        • Opcode ID: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
                                                                                                                                                        • Instruction ID: ce8d9142a08082602957e39f3b723dd1a5a75d625bc2628654832b93868514b7
                                                                                                                                                        • Opcode Fuzzy Hash: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
                                                                                                                                                        • Instruction Fuzzy Hash: DE41487150C7C18FD3219B38884869EBFE16BA7324F094A9DE5E4873D2C7B58506C753
                                                                                                                                                        Function 00521AE3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • type_info::operator==.LIBVCRUNTIME ref: 00521C02
                                                                                                                                                        • ___TypeMatch.LIBVCRUNTIME ref: 00521D10
                                                                                                                                                        • CatchIt.LIBVCRUNTIME ref: 00521D61
                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00521E62
                                                                                                                                                        • CallUnexpected.LIBVCRUNTIME ref: 00521E7D
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                        • API String ID: 4119006552-393685449
                                                                                                                                                        • Opcode ID: effc6da35d74a7d035f88943ec416ee25d28e11b1caf8c628bb656303d7db470
                                                                                                                                                        • Instruction ID: 7c8f095cb6e2ff272f3a9577f0a1106048fca3a6e5f6395305ce30490c8286ca
                                                                                                                                                        • Opcode Fuzzy Hash: effc6da35d74a7d035f88943ec416ee25d28e11b1caf8c628bb656303d7db470
                                                                                                                                                        • Instruction Fuzzy Hash: FAB1BF75800A2ADFCF18DFA4E8449AFBFB9FF66300B154459E8006B281D730DE51CB99
                                                                                                                                                        Function 0052CFD7 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 0052D3DC: CreateFileW.KERNEL32(00000000,00000000,?,0052D080,?,?,00000000,?,0052D080,00000000,0000000C), ref: 0052D3F9
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0052D0EB
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D0F2
                                                                                                                                                        • GetFileType.KERNEL32(00000000), ref: 0052D0FE
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0052D108
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D111
                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 0052D131
                                                                                                                                                        • CloseHandle.KERNEL32(00527C1E), ref: 0052D27E
                                                                                                                                                        • GetLastError.KERNEL32 ref: 0052D2B0
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 0052D2B7
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4237864984-0
                                                                                                                                                        • Opcode ID: a1a02a2f5dc91bacfa8a434b814d76f8a0ac1a839393f69598a0739bdc03365f
                                                                                                                                                        • Instruction ID: 95801759757d2290a807a9987b3ee1569e1fa2a2aef47a57c129e08d714b50ff
                                                                                                                                                        • Opcode Fuzzy Hash: a1a02a2f5dc91bacfa8a434b814d76f8a0ac1a839393f69598a0739bdc03365f
                                                                                                                                                        • Instruction Fuzzy Hash: 37A13132A141699FCF199F68EC96BAE3FB1BF4B310F140149E8019B3E1DB359816DB61
                                                                                                                                                        Function 00524D1B Relevance: 10.8, APIs: 7, Instructions: 329COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: _strrchr
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3213747228-0
                                                                                                                                                        • Opcode ID: a8e5336aae3c51094d57f33ed622fdcb4f0028160ae107eaa9530d56252e24a8
                                                                                                                                                        • Instruction ID: f99c97effe65b96dd2d0d0bf688d59971bd5363efacc6c3c50cdaa241900c6e7
                                                                                                                                                        • Opcode Fuzzy Hash: a8e5336aae3c51094d57f33ed622fdcb4f0028160ae107eaa9530d56252e24a8
                                                                                                                                                        • Instruction Fuzzy Hash: 9EB15632A00276AFEB15CF64EC85BAE7FA5FF96310F154155E904AB3C2E3749941CBA0
                                                                                                                                                        Function 0051C320 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C357
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 0051C35F
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C3E8
                                                                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 0051C413
                                                                                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0051C468
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                        • String ID: csm
                                                                                                                                                        • API String ID: 1170836740-1018135373
                                                                                                                                                        • Opcode ID: c9a556edd72278a5d638d7e383d0a746d974b08ff7b55325465554bb9ee3d4bc
                                                                                                                                                        • Instruction ID: 013bef958af9ab0d9f58a9458bb26756363efecf4e4039a7b96ff65987c574d7
                                                                                                                                                        • Opcode Fuzzy Hash: c9a556edd72278a5d638d7e383d0a746d974b08ff7b55325465554bb9ee3d4bc
                                                                                                                                                        • Instruction Fuzzy Hash: E1410534A00219ABCF10DF68C885ADEBFB0FF45314F14C555E824AB392D772EA85CB91
                                                                                                                                                        Function 0052273A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,00522849,00000000,3A61198B,00000000,00000000,00000000,?,005225FB,00000022,FlsSetValue,00531ED0,00531ED8,00000000), ref: 005227FB
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                                        • API String ID: 3664257935-537541572
                                                                                                                                                        • Opcode ID: e07a4b20fa52c9246089543c816b831958ffe4066ebfda0a1cac55c71587752f
                                                                                                                                                        • Instruction ID: d54299e3af2bc88d0e1994d7b2785d07253716b0d82aedfb577cdd726ccc0da0
                                                                                                                                                        • Opcode Fuzzy Hash: e07a4b20fa52c9246089543c816b831958ffe4066ebfda0a1cac55c71587752f
                                                                                                                                                        • Instruction Fuzzy Hash: CA21D57AE09225BBD7319B24BC84A6A3F58FF57760F290110F915A72D0D730ED05E6E0
                                                                                                                                                        Function 00506290 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 41COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___std_exception_destroy.LIBVCRUNTIME ref: 005062AC
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___std_exception_destroy
                                                                                                                                                        • String ID: ]IC9$]IC9$]IC9$]IC9$]IC9
                                                                                                                                                        • API String ID: 4194217158-2037520495
                                                                                                                                                        • Opcode ID: db58a8d35a3c46af18cefb36ee55e2c82bd8bc06ab1d5c76b790da8fc9239880
                                                                                                                                                        • Instruction ID: f8c3fd8fb5d5b70b6cbd5c29570fce2cc17f7700197f96165edb477914b72bfd
                                                                                                                                                        • Opcode Fuzzy Hash: db58a8d35a3c46af18cefb36ee55e2c82bd8bc06ab1d5c76b790da8fc9239880
                                                                                                                                                        • Instruction Fuzzy Hash: B9014EB190511287D9106B3C98852AE7FD07F25708F504D6DF495DB250E330ECA4CBC3
                                                                                                                                                        Function 005281FD Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 4a23f90ab2ca136bb85f4301994ee6345dd8f75979a585a04521656580ab9aba
                                                                                                                                                        • Instruction ID: 6729bfd62ed46d668473b12012ff0d415f68a076f7a87d5c3367335241e7f314
                                                                                                                                                        • Opcode Fuzzy Hash: 4a23f90ab2ca136bb85f4301994ee6345dd8f75979a585a04521656580ab9aba
                                                                                                                                                        • Instruction Fuzzy Hash: 9DB1D0B0A0526AAFDB11DFE8E884BBE7FB5BF96354F144158E500972C2CB709941CB90
                                                                                                                                                        Function 0052E506 Relevance: 9.2, APIs: 6, Instructions: 248COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: __freea$Info
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 541289543-0
                                                                                                                                                        • Opcode ID: ad36652516701d584dd5ce29175403be39c27d8f5ae5192088788222f28ebe36
                                                                                                                                                        • Instruction ID: 4c117725ad2a34dd2ef1b7786f8149111be5fb0b288df05a3b0a6dd706af482f
                                                                                                                                                        • Opcode Fuzzy Hash: ad36652516701d584dd5ce29175403be39c27d8f5ae5192088788222f28ebe36
                                                                                                                                                        • Instruction Fuzzy Hash: 4871E572A002669BDF209E64AC87BAE7FB6FF97714F2C0415E904A72C1E735AC408760
                                                                                                                                                        Function 00521243 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetLastError.KERNEL32(?,?,0052123A,0051C0FD,0051B7A4), ref: 00521251
                                                                                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0052125F
                                                                                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00521278
                                                                                                                                                        • SetLastError.KERNEL32(00000000,0052123A,0051C0FD,0051B7A4), ref: 005212CA
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 3852720340-0
                                                                                                                                                        • Opcode ID: 8c824e6d79ce9907703927ab0627e95ca7faef46f07764d8249e61a8b8bd3b32
                                                                                                                                                        • Instruction ID: 01d095279d621ed61b5e482c57a293b875b5f196f68026d2094913fb4aa73af5
                                                                                                                                                        • Opcode Fuzzy Hash: 8c824e6d79ce9907703927ab0627e95ca7faef46f07764d8249e61a8b8bd3b32
                                                                                                                                                        • Instruction Fuzzy Hash: 2201D87A50AA329EEA241BB97C8A56B2F95FF733743200229F510D01F1EF514C14E598
                                                                                                                                                        Function 0051ED2E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,005303E8,000000FF,?,0051EDEF,0051ECD6,?,0051EE8B,00000000), ref: 0051ED63
                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0051ED75
                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,00000000,005303E8,000000FF,?,0051EDEF,0051ECD6,?,0051EE8B,00000000), ref: 0051ED97
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                        • Opcode ID: facb527fe486dfc3fc3d87f2375e4c643ff25ae6e63a15fa277d8cd95c3230da
                                                                                                                                                        • Instruction ID: 44ed1003e9c7bc8b19f3fdc78ae7ecd0c94e6a04e93c3a334f4e6b92dd6cfd77
                                                                                                                                                        • Opcode Fuzzy Hash: facb527fe486dfc3fc3d87f2375e4c643ff25ae6e63a15fa277d8cd95c3230da
                                                                                                                                                        • Instruction Fuzzy Hash: 04014F72954659ABEB118B54DC09FAEBFB9FB08B11F040629F811A22D0DB749944DA90
                                                                                                                                                        Function 00521F08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00521E0E,?,?,00000000,00000000,00000000,?), ref: 00521F2D
                                                                                                                                                        • CatchIt.LIBVCRUNTIME ref: 00522013
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CatchEncodePointer
                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                        • API String ID: 1435073870-2084237596
                                                                                                                                                        • Opcode ID: f146a4f4fdc60c38d494519a2debc56b512c809ed449cc619f4a9f5b9ac737fc
                                                                                                                                                        • Instruction ID: 70d65da5a048f2690b0e42a9912f81b9840eec3ca98f3c6b3e9deb5fa391f308
                                                                                                                                                        • Opcode Fuzzy Hash: f146a4f4fdc60c38d494519a2debc56b512c809ed449cc619f4a9f5b9ac737fc
                                                                                                                                                        • Instruction Fuzzy Hash: BD41A972900219AFCF19CF94ED85AEEBFB5FF49300F188058F914A72A1D335A951DBA0
                                                                                                                                                        Function 00529081 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000008,00000000,00000800,?,0052911D,?,-00000001,-00000001,?,?,?,00528F65,00000000,FlsAlloc,00532824,0053282C), ref: 0052908E
                                                                                                                                                        • GetLastError.KERNEL32(?,0052911D,?,-00000001,-00000001,?,?,?,00528F65,00000000,FlsAlloc,00532824,0053282C,?,-00000001,005211F1), ref: 00529098
                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000008,00000000,00000000,00538A38,00000008,004EAC6A), ref: 005290C0
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                        • API String ID: 3177248105-2084034818
                                                                                                                                                        • Opcode ID: 7108932ed3c8922f2a3cb5941bf3150ae448eef561934624bfae87d41f8f4c64
                                                                                                                                                        • Instruction ID: 20f7e5cb003ee46b48323bda55975864eb28e6e08601a33182b4fceefbb68de1
                                                                                                                                                        • Opcode Fuzzy Hash: 7108932ed3c8922f2a3cb5941bf3150ae448eef561934624bfae87d41f8f4c64
                                                                                                                                                        • Instruction Fuzzy Hash: 1EE04F71A8460CB7EB301B61FC0AB5C3F94BF25B41F104020F90CE92E5E7A1E915A988
                                                                                                                                                        Function 00529A3F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00529AA2
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00529CF4
                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00529D3A
                                                                                                                                                        • GetLastError.KERNEL32 ref: 00529DDD
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2112829910-0
                                                                                                                                                        • Opcode ID: c8951896db29eff0390352c96d5f209eb154277756c6ccd5ea4b25ff28c161e0
                                                                                                                                                        • Instruction ID: 8d9cb56d5d5df2b43d74483e379606aabcbd0c4d1d5c5000e508341fed1eb24b
                                                                                                                                                        • Opcode Fuzzy Hash: c8951896db29eff0390352c96d5f209eb154277756c6ccd5ea4b25ff28c161e0
                                                                                                                                                        • Instruction Fuzzy Hash: 5ED18AB5D042699FCF14CFA8E8849EDBFB4FF4A300F24452AE456EB392D630A945CB50
                                                                                                                                                        Function 0052190C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: AdjustPointer
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1740715915-0
                                                                                                                                                        • Opcode ID: 7b3a18acbb794778c04c5c965084f9fbddfe8fbd224fded99feae239d3080ffc
                                                                                                                                                        • Instruction ID: 296bb57558fa2788b73c3bf122532e147c49df20566aff572f4ed999fc3e0fea
                                                                                                                                                        • Opcode Fuzzy Hash: 7b3a18acbb794778c04c5c965084f9fbddfe8fbd224fded99feae239d3080ffc
                                                                                                                                                        • Instruction Fuzzy Hash: FB51F272602A26AFEB298F50E855BBB7FA4FF62310F24052DE805572D1E731AC80C794
                                                                                                                                                        Function 004EE0C0 Relevance: 6.1, APIs: 4, Instructions: 94threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004EE0FC
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: CurrentThread
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2882836952-0
                                                                                                                                                        • Opcode ID: 86f6716092cd18e2372f22921611a1617987aaf91f5fde02fb865e6849f1741d
                                                                                                                                                        • Instruction ID: 5edaf0179aeb704250ba323420d0a6c0c9cec44fe7ec35a4814f226bbcadc8cc
                                                                                                                                                        • Opcode Fuzzy Hash: 86f6716092cd18e2372f22921611a1617987aaf91f5fde02fb865e6849f1741d
                                                                                                                                                        • Instruction Fuzzy Hash: 23214874A442818FDB345B1BCC8676ABBD0AF89711F24482BF44ACB361D675CCC4974B
                                                                                                                                                        Function 00526155 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,?,005264FB,?,?,?,00000000), ref: 005261B9
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 005261C0
                                                                                                                                                        • GetLastError.KERNEL32(00000000,005264FB,?,?,00000000,?,?,?,00000000,00000000,?,005264FB,?,?,?,00000000), ref: 005261FA
                                                                                                                                                        • __dosmaperr.LIBCMT ref: 00526201
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 1913693674-0
                                                                                                                                                        • Opcode ID: 4d1a6829e5e7890ddc76033caea71163f6c8a05ef048588a8948280c6b99ab62
                                                                                                                                                        • Instruction ID: 515c7059d344d2e26daff77ecb5ce7541ae6556eabc0573291f446254cf7652b
                                                                                                                                                        • Opcode Fuzzy Hash: 4d1a6829e5e7890ddc76033caea71163f6c8a05ef048588a8948280c6b99ab62
                                                                                                                                                        • Instruction Fuzzy Hash: AD21B37160473AAFDB20AF65EC8582FBFA9FF963647104558F81597292D730EC50CB50
                                                                                                                                                        Function 005266F4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: a113f33ccece13937f9384f2d914ebb7694e33fecce0141fe8cda064dd60a32e
                                                                                                                                                        • Instruction ID: eed7b69d6bf31eda2eaa1404c813dd590c68b4cb6a637e71ba9507b08fc2880f
                                                                                                                                                        • Opcode Fuzzy Hash: a113f33ccece13937f9384f2d914ebb7694e33fecce0141fe8cda064dd60a32e
                                                                                                                                                        • Instruction Fuzzy Hash: F5216F7160423AAFDB20AF71FC8596B7FA9FF923687184519F815971D1DB30EC508B90
                                                                                                                                                        Function 00526EAB Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32 ref: 00526EB3
                                                                                                                                                          • Part of subcall function 00526DAF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,005294E8,?,00000000,-00000008), ref: 00526E10
                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00526EEB
                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00526F0B
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 158306478-0
                                                                                                                                                        • Opcode ID: 5dbcdcdf7bbc5dc22a4b1515f7bdf47aa57e9c93223e241de0666b352723a76e
                                                                                                                                                        • Instruction ID: a8e6d052888f45ac3012676f7f2b1029a06d97a00fae862fcbbd471070fdf847
                                                                                                                                                        • Opcode Fuzzy Hash: 5dbcdcdf7bbc5dc22a4b1515f7bdf47aa57e9c93223e241de0666b352723a76e
                                                                                                                                                        • Instruction Fuzzy Hash: 7D11A1F291953A7F6B2167B27E8DC7F2D5CFEAB3947100464F50191281EA64CE4191B0
                                                                                                                                                        Function 0052EA4B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000), ref: 0052EA62
                                                                                                                                                        • GetLastError.KERNEL32(?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?,?,?,00529777,?), ref: 0052EA6E
                                                                                                                                                          • Part of subcall function 0052EAC0: CloseHandle.KERNEL32(FFFFFFFE,0052EA7E,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?,?), ref: 0052EAD0
                                                                                                                                                        • ___initconout.LIBCMT ref: 0052EA7E
                                                                                                                                                          • Part of subcall function 0052EAA0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0052EA3C,0052D9AB,?,?,00529E31,?,00000000,00000000,?), ref: 0052EAB3
                                                                                                                                                        • WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0052D9BE,00000000,00000001,?,?,?,00529E31,?,00000000,00000000,?), ref: 0052EA93
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 2744216297-0
                                                                                                                                                        • Opcode ID: 0b312deea0d300b70540724452b1264dc414b961ca2e224c548c6bed094aed26
                                                                                                                                                        • Instruction ID: 36ca6ad64cc6af21a317ec16feff8c05a51795d7570fa86c8f92f00dc85b63a5
                                                                                                                                                        • Opcode Fuzzy Hash: 0b312deea0d300b70540724452b1264dc414b961ca2e224c548c6bed094aed26
                                                                                                                                                        • Instruction Fuzzy Hash: 3FF03736500129BBCF225F91EC0E99D3F66FF593A1B054010FA09D5270C7729924FB90
                                                                                                                                                        Function 0041CBE6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273threadCOMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 0041CCA3
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ProcessThreadWindow
                                                                                                                                                        • String ID: ;:54$TU
                                                                                                                                                        • API String ID: 1653199695-2129887498
                                                                                                                                                        • Opcode ID: 4af5c4ad50dbf8e3ea00b90cc7a03d7b7d5ae7b00e7b789710216c4470d5e8ae
                                                                                                                                                        • Instruction ID: 994451c890a539b70b135d86ab13cbbfb130f4c9854e9402de8351a222cc8c75
                                                                                                                                                        • Opcode Fuzzy Hash: 4af5c4ad50dbf8e3ea00b90cc7a03d7b7d5ae7b00e7b789710216c4470d5e8ae
                                                                                                                                                        • Instruction Fuzzy Hash: 8491CE75608301DFD714CF24DC8166BB7B2FF8A719F19882DE584872A1E738E845CB8A
                                                                                                                                                        Function 0052177C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00521785
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152375587.00000000004E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 004E0000, based on PE: true
                                                                                                                                                        • Associated: 0000000E.00000002.3152332669.00000000004E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152470394.0000000000531000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152488679.0000000000539000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152512175.000000000053D000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        • Associated: 0000000E.00000002.3152787835.000000000053F000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_4e0000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: ___except_validate_context_record
                                                                                                                                                        • String ID: csm$csm
                                                                                                                                                        • API String ID: 3493665558-3733052814
                                                                                                                                                        • Opcode ID: 84fca27631db27ad021245c88becad393186ceed78c7508958c4ee27411a1078
                                                                                                                                                        • Instruction ID: 12442678c8624a6ebae1f73a37871c223f253a3062bf81fadd456c9a2124554e
                                                                                                                                                        • Opcode Fuzzy Hash: 84fca27631db27ad021245c88becad393186ceed78c7508958c4ee27411a1078
                                                                                                                                                        • Instruction Fuzzy Hash: 69312836400635EFCF268F50EC849AB7F65FF6A715B18865AF814591A1C332CC62DBC5
                                                                                                                                                        Function 004356A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        APIs
                                                                                                                                                        Strings
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 0000000E.00000002.3152171306.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_c.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID: MetricsSystem
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID: 4116985748-3916222277
                                                                                                                                                        • Opcode ID: 3dcdef9236adf8ca386dc6fb97340a86e3694599f7ba400ddce7260dc1c74294
                                                                                                                                                        • Instruction ID: 9732a33b7570d1acdeca4753070807439da1dc5417158f41187a2c532eae33b3
                                                                                                                                                        • Opcode Fuzzy Hash: 3dcdef9236adf8ca386dc6fb97340a86e3694599f7ba400ddce7260dc1c74294
                                                                                                                                                        • Instruction Fuzzy Hash: 9531A1B49143048FDB40EF7CD98561EBBF4BB89304F11856DE488DB360DB70A948CB96

                                                                                                                                                        Executed Functions

                                                                                                                                                        Function 00007FFD34651175 Relevance: 2.4, Instructions: 2414COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000013.00000002.3244572879.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_19_2_7ffd34650000_449e940ceb.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 97a62937c7243715964837ba206ca7f18a6e513d12c91d0874d3c23e295549d6
                                                                                                                                                        • Instruction ID: 60910387dcae6d6af6bfd193e6e40d3034cf1b334235f5f4635505cf74566edb
                                                                                                                                                        • Opcode Fuzzy Hash: 97a62937c7243715964837ba206ca7f18a6e513d12c91d0874d3c23e295549d6
                                                                                                                                                        • Instruction Fuzzy Hash: A813D230618E498FD7A4EB28C4A9BEB73E1FF99302F50456DD44EC72A6CE75A841CB41
                                                                                                                                                        Function 00007FFD346508CD Relevance: .0, Instructions: 23COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000013.00000002.3244572879.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_19_2_7ffd34650000_449e940ceb.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: 00cfd7cc011071123270f59a49ce76fbd1c264a5c279fee05791efd5351c5935
                                                                                                                                                        • Instruction ID: f5505f6226732c9180a11f81c1d2d6043bf70b777ddc4ae04f6af65b74559dd7
                                                                                                                                                        • Opcode Fuzzy Hash: 00cfd7cc011071123270f59a49ce76fbd1c264a5c279fee05791efd5351c5935
                                                                                                                                                        • Instruction Fuzzy Hash: 26E08053E1DEA54FD7A59A2C09F61947FB0DF1A20070504EFC549C71D3E5099C0C93D2